IT Compliance Knowledge Hub

IT Compliance Directory: standards, laws and frameworks

A plain-English guide to the compliance standards, regulations, certifications and acts that apply to IT companies, software developers, SaaS businesses and IT service providers. Each entry says what it covers, who needs it, whether it is mandatory, and links to a full guide with official sources.

  • 65 standards, laws and frameworks
  • 12 categories
  • 23 in-depth guides
  • Last reviewed
IT Compliance Directory banner: shield, checklist and document icons representing security standards, privacy laws and IT frameworks
Start here

Law, standard, framework or certification: what's the difference?

Each entry below is labelled with its type and whether it is mandatory. This matters: a law applies whether or not you choose it, while a standard applies only when you, a client or a regulator decide it should.

Law

Laws and regulations

Passed by a legislature or issued by a regulator. If you are in scope you must comply, and regulators can fine you. Examples: GDPR, HIPAA, India's DPDP Act, CERT-In Directions.

Certifiable standard

Certifiable standards

Voluntary management-system standards (mostly ISO). An accredited certification body audits you and issues a certificate, usually valid for three years with yearly surveillance audits. Examples: ISO 27001, ISO 22301, ISO 42001.

Attestation report

Attestation reports

A licensed CPA firm examines your controls and issues a report you share with customers under NDA. There is no certificate. Example: SOC 2 Type I and Type II.

Framework

Frameworks and guidance

Voluntary best-practice structures and control catalogues. You can align with them or map other standards to them, but there is no official certificate of the framework itself. Examples: NIST CSF, CIS Controls, COBIT, OWASP Top 10.

Industry standard

Industry and contractual standards

Not a law, but enforced through contracts. If you store, process or transmit card data, your bank and the card brands require PCI DSS.

Government authorization

Government authorizations

Programmes a government runs before its agencies may buy your product. Example: FedRAMP for cloud services sold to US federal agencies.

Browse by category

Compliance categories

Twelve groups, from information security and privacy to AI governance and Indian IT law. Many standards appear in more than one.

Information SecurityManagement systems and control sets that protect the confidentiality, integrity and availability of information. 9 Data Privacy & ProtectionLaws and standards that govern how personal data is collected, used, shared, stored and deleted. 15 CybersecurityFrameworks and incident-reporting rules for defending systems, detecting attacks and recovering from them. 16 IT Governance & Risk ManagementHow IT is directed, controlled, measured and audited, from boardroom governance to service management and quality. 12 Cloud SecurityStandards and authorizations for cloud service providers and the SaaS products built on them. 7 Software DevelopmentStandards for building software securely, from coding and testing to supply chain and vulnerability handling. 7 Payment & Financial DataRules for card data, financial reporting systems and the IT of banks, insurers, brokers and fintechs. 9 Healthcare ITRules for software and services that create, store or transmit patient health information. 3 AI Governance & ComplianceLaws and management standards for developing, deploying and using artificial intelligence responsibly. 4 Business Continuity & DRHow to keep critical services running through outages, cyberattacks and disasters, and recover them within agreed times. 4 International IT RegulationsNational and regional laws that apply to IT companies serving customers abroad. 28 Indian IT Laws & RegulationsActs, rules and directions that apply to IT companies, SaaS businesses and IT service providers in India. 9
The directory

All IT compliance standards, laws and frameworks

Filter by category, type or region, or search by name. Open an entry for what it covers, who needs it and its key requirements.

ISO 27001

ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection: Information security management systems (ISMS) requirements

Certifiable standard Voluntary Global

ISO/IEC 27001 is the international standard for an information security management system (ISMS). It requires you to define a scope, assess information security risks, choose controls from Annex A (93 controls in four themes) or elsewhere, and run a cycle of monitoring, internal audit, management review and improvement. It is voluntary, but an accredited ISO 27001 certificate is the most widely recognised proof of security for IT companies worldwide.

Covers, who needs it and key requirements
What it covers
Governance of information security: scope, risk assessment and treatment, policies, Annex A controls (organisational, people, physical, technological), internal audit, management review and continual improvement.
Who needs it
IT service providers, software and SaaS companies, data centres, BPOs, fintechs and any organisation whose clients ask for independent proof of information security.
Why it matters
It answers most security questionnaires with one certificate, is recognised in every market and is often a precondition for enterprise, banking and government contracts.
Applies in
Worldwide (international standard)
Key requirements
  • Define the ISMS scope and context (clauses 4.1 to 4.4)
  • Leadership commitment and an information security policy (clause 5)
  • Risk assessment, risk treatment plan and Statement of Applicability (clause 6)
  • Resources, competence, awareness and documented information (clause 7)
  • Operate and monitor controls, internal audit and management review (clauses 8 and 9)
  • Corrective action and continual improvement (clause 10)

SOC 2

System and Organization Controls 2 (SOC 2) report on controls relevant to security, availability, processing integrity, confidentiality or privacy

Attestation report Voluntary US / global

SOC 2 is an independent attestation report, produced by a licensed CPA firm under AICPA standards, on how a service organisation's controls meet the Trust Services Criteria for security and, optionally, availability, processing integrity, confidentiality and privacy. A Type I report tests control design at a point in time; a Type II report tests operating effectiveness over a period, usually 6 to 12 months. It is the security report most US enterprise customers ask SaaS vendors for.

Covers, who needs it and key requirements
What it covers
Security (the mandatory common criteria CC1 to CC9: control environment, risk assessment, monitoring, logical and physical access, system operations, change management, risk mitigation) plus optional availability, processing integrity, confidentiality and privacy criteria.
Who needs it
SaaS, cloud, data and managed service providers that store or process customer data, especially those selling to US enterprises.
Why it matters
It is the default evidence enterprise security and procurement teams request, and a clean Type II report shortens security reviews.
Applies in
United States origin; used worldwide by companies selling to US-based customers
Key requirements
  • Define the system description and the Trust Services Criteria in scope
  • Control environment and governance (CC1, CC2)
  • Risk assessment and vendor risk management (CC3, CC9)
  • Logical and physical access controls (CC6)
  • System operations, monitoring and incident response (CC4, CC7)
  • Change management (CC8) and evidence that each control ran during the audit period

DPDP Act

Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (India)

Law Mandatory by law India, extraterritorial

India's Digital Personal Data Protection Act, 2023 governs the processing of digital personal data. Data fiduciaries must give clear notice, obtain free, specific and informed consent (or rely on a listed legitimate use), protect data with reasonable security safeguards, report breaches to the Data Protection Board and affected people, honour rights to access, correction, erasure and grievance redress, and delete data when no longer needed. The DPDP Rules 2025 phase most duties in from 13 May 2027. Penalties reach INR 250 crore.

Covers, who needs it and key requirements
What it covers
Digital personal data (and non-digital data later digitised): notice and consent, legitimate uses, consent managers, data fiduciary duties, processors, security safeguards, breach notification, children's and disabled persons' data, data principal rights, Significant Data Fiduciaries, cross-border transfers and the Data Protection Board.
Who needs it
Every Indian IT company, SaaS provider, app and IT service provider that processes personal data, and foreign companies offering goods or services to people in India. IT service providers acting for clients are data processors bound by contract.
Why it matters
It replaces the limited SPDI Rules with a full privacy regime, has penalties up to INR 250 crore per breach, and Indian and foreign clients will expect DPDP-ready processors.
Applies in
India; applies extraterritorially to processing connected with offering goods or services to data principals in India
Key requirements
  • Itemised notice in clear language before or at the time of seeking consent (Section 5, Rule 3)
  • Consent that is free, specific, informed, unconditional and unambiguous, with easy withdrawal (Section 6)
  • Reasonable security safeguards: encryption or masking, access control, logs kept at least one year, backups (Section 8(5), Rule 6)
  • Breach intimation to each affected person and to the Board without delay, with a detailed report within 72 hours (Section 8(6), Rule 7)
  • Verifiable parental consent for children's data; no tracking or targeted advertising to children (Section 9, Rule 10)
  • Rights to access, correction, erasure, grievance redressal and nomination, and processor contracts (Sections 8(2), 11 to 14)

IT Act 2000

Information Technology Act, 2000 (India), as amended in 2008, with rules made under it

Law Mandatory by law India

The Information Technology Act, 2000 is India's core law for electronic commerce and cybersecurity. It gives legal recognition to electronic records and signatures, defines cyber offences such as hacking, identity theft and data theft, makes companies liable to compensate for negligent handling of sensitive data (Section 43A, until the DPDP Act replaces it), sets due diligence and safe harbour rules for intermediaries (Section 79), and empowers CERT-In to issue binding directions (Section 70B).

Covers, who needs it and key requirements
What it covers
Electronic records and signatures, cyber contraventions and offences, corporate data protection (Section 43A and SPDI Rules), intermediary due diligence and safe harbour, government interception and blocking powers, critical information infrastructure and CERT-In's powers.
Who needs it
Every company operating computer systems in India: IT and software companies, SaaS and app providers, hosting and cloud providers, and intermediaries such as platforms and marketplaces.
Why it matters
It defines what is a crime, when you must pay compensation, and what intermediaries must do to keep safe harbour; CERT-In's binding directions come from it.
Applies in
India; extends to acts outside India involving computers or networks located in India (Section 75)
Key requirements
  • Reasonable security practices for sensitive personal data under Section 43A and the SPDI Rules 2011 (until 13 May 2027)
  • Intermediary due diligence under Section 79 and the IT Rules 2021, including grievance officers and takedown timelines
  • Comply with CERT-In directions under Section 70B (incident reporting, logs, clock sync)
  • Preserve and provide information when lawfully directed (Sections 67C, 69, 69B)
  • Protect against and report offences such as unauthorised access and data theft (Sections 43, 66)
  • Contracts that protect confidentiality of information accessed while providing services (Section 72A)

CERT-In Directions

CERT-In Directions of 28 April 2022 under Section 70B(6) of the Information Technology Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents

Regulation Mandatory by law India

CERT-In's Directions of 28 April 2022 are binding rules for almost every organisation running IT systems in India. They require reporting listed cyber incidents to CERT-In within six hours of noticing them, keeping logs of all ICT systems for a rolling 180 days within India, synchronising clocks with NIC or NPL time servers, and naming a point of contact. Data centres, VPS, cloud and VPN providers must keep subscriber records for five years. Non-compliance is a criminal offence under Section 70B(7).

Covers, who needs it and key requirements
What it covers
Cyber incident reporting (20 listed incident types), log retention, clock synchronisation, point of contact, information requests from CERT-In, subscriber records for data centre, VPS, cloud and VPN providers, and KYC records for virtual asset service providers.
Who needs it
IT companies, SaaS providers, data centres, cloud, VPS and VPN providers, intermediaries, body corporates and government organisations operating in India.
Why it matters
The six-hour reporting window is one of the strictest in the world and failing to comply is a criminal offence, so incident response plans for India must be built around it.
Applies in
India
Key requirements
  • Report listed cyber incidents to CERT-In within 6 hours of noticing them (incident@cert-in.org.in or the reporting portal)
  • Enable and keep logs of all ICT systems securely for a rolling 180 days within Indian jurisdiction
  • Synchronise system clocks with the NTP servers of NIC or NPL (or traceable sources)
  • Designate a point of contact to interface with CERT-In and share details
  • Provide information and assistance when CERT-In asks
  • Data centres, VPS, cloud and VPN providers: keep validated subscriber records for 5 years; VASPs keep KYC and transaction records for 5 years

GDPR

General Data Protection Regulation, Regulation (EU) 2016/679

Law Mandatory by law EU / EEA, extraterritorial

The GDPR is the EU's data protection law. It applies to any organisation that processes personal data in the context of an EU establishment, and to non-EU companies that offer goods or services to people in the EU or monitor their behaviour. It requires a lawful basis for processing, transparency, data minimisation, security, records of processing, data subject rights and breach notification within 72 hours. Fines reach EUR 20 million or 4% of global turnover.

Covers, who needs it and key requirements
What it covers
Personal data of people in the EU: principles, lawful bases, consent, transparency, data subject rights, controller and processor duties, data protection by design, DPIAs, DPOs, security, breach notification, international transfers and enforcement.
Who needs it
EU companies and any IT, SaaS or outsourcing company worldwide with EU users, customers or clients, including processors acting for EU clients.
Why it matters
It is the global benchmark for privacy law, carries some of the highest fines, and EU clients will not sign without a GDPR-compliant data processing agreement.
Applies in
European Union and EEA; applies extraterritorially to non-EU companies targeting or monitoring people in the EU
Key requirements
  • Lawful basis for every processing purpose (Article 6) and conditions for special category data (Article 9)
  • Transparent privacy notices (Articles 13 and 14)
  • Data subject rights: access, rectification, erasure, portability, objection (Articles 15 to 22)
  • Records of processing, DPIAs and, where required, a DPO (Articles 30, 35, 37)
  • Security of processing and breach notification within 72 hours (Articles 32 to 34)
  • Processor contracts and safeguards for transfers outside the EEA (Articles 28, 44 to 49)

EU AI Act

Artificial Intelligence Act, Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI (2026)

Law Mandatory if in scope EU, extraterritorial

The EU AI Act is the world's first comprehensive AI law. It sorts AI into risk tiers: prohibited practices (banned since February 2025), high-risk systems (strict requirements, now applying from 2 December 2027 and 2 August 2028 after the 2026 Digital Omnibus), limited-risk systems with transparency duties (from August 2026), and minimal risk. General-purpose AI model providers have had obligations since August 2025. It applies to providers and deployers inside and outside the EU, with fines up to EUR 35 million or 7% of turnover.

Covers, who needs it and key requirements
What it covers
AI systems and general-purpose AI models placed on the EU market or used in the EU: prohibited practices, high-risk classification, risk management, data governance, documentation, logging, transparency, human oversight, accuracy and cybersecurity, conformity assessment, post-market monitoring, GPAI duties and penalties.
Who needs it
AI product and SaaS companies selling to EU customers, IT service providers building AI systems for EU clients, and companies deploying AI in hiring, credit, education, healthcare or other high-risk uses.
Why it matters
It applies to non-EU companies, its fines exceed the GDPR's, and EU clients will require AI Act compliance in contracts.
Applies in
European Union; applies extraterritorially to non-EU providers placing AI on the EU market or whose AI output is used in the EU
Key requirements
  • Inventory AI systems and classify each by risk tier and your role (provider, deployer, importer, distributor)
  • Stop any prohibited practice (Article 5) and support AI literacy among staff (Article 4)
  • Transparency: tell people they are interacting with AI and mark synthetic content (Article 50)
  • High-risk systems: risk management, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity (Articles 9 to 15)
  • High-risk providers: quality management system, conformity assessment, CE marking, EU database registration and post-market monitoring
  • GPAI model providers: technical documentation, copyright policy and training content summary; extra duties for systemic-risk models

ISO 27701

ISO/IEC 27701:2025 Information security, cybersecurity and privacy protection: Privacy information management systems (PIMS) requirements and guidance

Certifiable standard Voluntary Global

ISO/IEC 27701 sets requirements for a privacy information management system (PIMS) that governs how an organisation processes personally identifiable information (PII), as a controller, a processor or both. The 2025 edition is a standalone standard that no longer has to sit on top of ISO 27001, with controls for PII controllers and processors that map well to the GDPR and similar laws. It is voluntary and certifiable.

Covers, who needs it and key requirements
What it covers
Privacy governance, roles of PII controller and processor, privacy risk assessment, lawful basis and consent records, data subject rights, privacy by design, transfers, sub-processors, breach handling and records of processing.
Who needs it
SaaS and cloud providers, IT service providers and BPOs that process client personal data, and any company that wants independent proof of privacy controls for GDPR, DPDP or customer audits.
Why it matters
Enterprise clients and regulators look for evidence of privacy accountability. A certified PIMS answers privacy due diligence questions and supports processor obligations in data processing agreements.
Applies in
Worldwide (international standard)
Key requirements
  • Determine your role (PII controller, processor or both) and the PIMS scope
  • Privacy risk assessment and treatment, with a Statement of Applicability
  • Controller controls: purposes, lawful basis, consent, notices, data subject rights, privacy impact assessments
  • Processor controls: processing only on instructions, sub-processor management, return and deletion of PII
  • Records of PII processing, transfers and disclosures
  • Internal audit, management review and continual improvement

HIPAA

Health Insurance Portability and Accountability Act of 1996 (Privacy, Security, Breach Notification and Enforcement Rules)

Law Mandatory if in scope United States

HIPAA is the US federal law that protects health information. Its Privacy Rule limits how protected health information (PHI) is used and disclosed, its Security Rule requires administrative, physical and technical safeguards for electronic PHI, and its Breach Notification Rule sets deadlines for telling patients and HHS. It applies to covered entities and to business associates such as software vendors, cloud hosts and IT support firms that handle PHI on their behalf.

Covers, who needs it and key requirements
What it covers
Protected health information held or transmitted by covered entities and business associates: permitted uses and disclosures, patient rights, security risk analysis, safeguards for ePHI, business associate agreements and breach notification.
Who needs it
Health tech and EHR vendors, telehealth apps, medical billing and transcription providers, cloud and managed service providers, and offshore IT teams that create, receive, maintain or transmit PHI for US healthcare clients.
Why it matters
US healthcare clients cannot share PHI without a signed business associate agreement, and OCR fines and corrective action plans apply directly to business associates.
Applies in
United States (federal)
Key requirements
  • Sign business associate agreements (BAAs) with covered entities and your own subcontractors
  • Perform and document an accurate and thorough security risk analysis
  • Administrative safeguards: security officer, workforce training, access management, contingency plan
  • Physical safeguards: facility access, workstation and device controls
  • Technical safeguards: access control, audit controls, integrity, authentication, transmission security
  • Breach notification without unreasonable delay and no later than 60 days after discovery

CCPA / CPRA

California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020

Law Mandatory if in scope California, US

The CCPA, as amended by the CPRA, gives California residents rights to know, delete, correct and opt out of the sale or sharing of their personal information, and to limit use of sensitive personal information. It applies to for-profit businesses that meet revenue or data-volume thresholds, wherever they are based. Service providers and contractors must sign specific contract terms. New 2026 regulations add risk assessments, cybersecurity audits and automated decision-making rules.

Covers, who needs it and key requirements
What it covers
Personal information of California residents, including employees and B2B contacts: notices at collection, privacy policy, consumer rights, opt-out of sale or sharing, sensitive data limits, service provider contracts, data security, risk assessments, cybersecurity audits and ADMT.
Who needs it
For-profit businesses that do business in California and meet a threshold, and the SaaS, IT and data vendors that act as their service providers or contractors.
Why it matters
It is the most detailed US privacy law, it is actively enforced by a dedicated agency, and US clients pass its service provider terms down to their vendors.
Applies in
California, USA; applies to businesses anywhere that meet the thresholds
Key requirements
  • Notice at collection and a privacy policy updated every 12 months
  • Honour requests to know, delete, correct and opt out within 45 days
  • Do Not Sell or Share link and recognition of opt-out preference signals (Global Privacy Control)
  • Limit use of sensitive personal information where required
  • Service provider and contractor contracts with the terms in section 1798.100(d)
  • Reasonable security; risk assessments and cybersecurity audits where the 2026 rules apply

ISO 9001

ISO 9001:2026 Quality management systems: Requirements

Certifiable standard Voluntary Global

ISO 9001 is the international standard for a quality management system (QMS). It asks you to understand customer and stakeholder requirements, plan processes and risks, control how you design and deliver products and services, measure customer satisfaction and keep improving. For software and IT services firms it formalises requirements management, design and development control, testing, change control and supplier management. The 2026 edition was published in September 2026.

Covers, who needs it and key requirements
What it covers
Context and interested parties, quality policy and objectives, risks and opportunities, competence and awareness, operational planning, requirements review, design and development, supplier control, release, nonconforming outputs, customer satisfaction, internal audit and improvement.
Who needs it
Software development companies, IT services and managed service providers, system integrators and any supplier asked for a quality certificate in RFPs or government tenders.
Why it matters
It is the most widely held management system certificate in the world and a common minimum requirement in public and enterprise procurement.
Applies in
Worldwide (international standard)
Key requirements
  • Determine context, interested parties and QMS scope
  • Quality policy, objectives and assigned responsibilities
  • Address risks and opportunities and plan changes
  • Control design and development, suppliers and service delivery
  • Monitor customer satisfaction, run internal audits and management reviews
  • Correct nonconformities and improve continually

PCI DSS

Payment Card Industry Data Security Standard, version 4.0.1

Industry standard Contractually required Global

PCI DSS is the security standard for any business that stores, processes or transmits payment card data, or can affect its security. Version 4.0.1 has 12 principal requirements, from network security controls and protecting stored account data to vulnerability management, access control, logging and testing. Compliance is validated annually through a QSA's Report on Compliance or a Self-Assessment Questionnaire, depending on your merchant or service provider level.

Covers, who needs it and key requirements
What it covers
The cardholder data environment and connected systems: network security, secure configurations, protection of stored and transmitted account data, malware protection, secure software, access control, MFA, logging, security testing and security policies.
Who needs it
Merchants, payment service providers, payment gateways, e-commerce and SaaS platforms that handle card payments, and IT service providers with access to cardholder data environments.
Why it matters
Acquiring banks require it, and a breach without compliance exposes you to fraud liability, fines and losing card acceptance.
Applies in
Worldwide, wherever payment cards are accepted
Key requirements
  • Install and maintain network security controls (Req. 1) and secure configurations (Req. 2)
  • Protect stored account data and encrypt it in transit (Req. 3 and 4)
  • Protect against malware and develop secure systems and software (Req. 5 and 6)
  • Restrict access by need to know, identify users and use MFA (Req. 7 and 8), and restrict physical access (Req. 9)
  • Log and monitor all access and test security regularly (Req. 10 and 11)
  • Maintain an information security policy and programme (Req. 12)

NIST CSF 2.0

NIST Cybersecurity Framework (CSF) 2.0

Framework Voluntary US / global

The NIST Cybersecurity Framework 2.0 is a voluntary framework of cybersecurity outcomes organised into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It does not prescribe specific controls; instead it gives a common language, organisational profiles (current and target) and tiers to describe how rigorous your practices are. Version 2.0, released in February 2024, added the Govern function and supply chain risk management, and is designed for organisations of any size or sector.

Covers, who needs it and key requirements
What it covers
Cybersecurity governance, risk strategy and supply chain risk (Govern), asset and risk identification (Identify), safeguards (Protect), monitoring (Detect), incident response (Respond) and recovery (Recover), with references to detailed controls such as SP 800-53, ISO 27001 and CIS Controls.
Who needs it
Any organisation that wants a structured cybersecurity programme, including IT companies reporting cyber risk to boards, clients, investors or insurers, and US federal contractors.
Why it matters
It is the most widely recognised way to describe cybersecurity maturity, maps to most other standards, and is free.
Applies in
United States origin; used worldwide
Key requirements
  • Govern (GV): context, risk strategy, roles, policy, oversight and cybersecurity supply chain risk management
  • Identify (ID): asset management, risk assessment and improvement
  • Protect (PR): identity and access, awareness and training, data security, platform security, resilience
  • Detect (DE): continuous monitoring and adverse event analysis
  • Respond (RS): incident management, analysis, reporting and mitigation
  • Recover (RC): recovery plan execution and communication

NIST SP 800-53

NIST Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations

Framework Mandatory if in scope US federal

NIST SP 800-53 Revision 5 is the US government's catalogue of security and privacy controls, organised into 20 families from Access Control to Supply Chain Risk Management. Federal agencies must select controls from it using the Low, Moderate or High baselines in SP 800-53B, and FedRAMP builds on it for cloud services. Private companies use it as the most detailed public control library. Release 5.2.0 in August 2025 strengthened software update and patching controls.

Covers, who needs it and key requirements
What it covers
Twenty control families: AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI and SR, covering technical, operational, management, privacy and supply chain safeguards.
Who needs it
US federal agencies, federal contractors and cloud providers pursuing FedRAMP, plus organisations that want a detailed control catalogue for high-assurance systems.
Why it matters
It is the control foundation for FISMA, FedRAMP and many state and sector programmes, and the reference most other frameworks map to.
Applies in
United States (federal); used worldwide as a reference catalogue
Key requirements
  • Categorise the system (FIPS 199) and select a Low, Moderate or High baseline (SP 800-53B)
  • Tailor controls and document them in a System Security and Privacy Plan
  • Implement controls across the 20 families
  • Assess controls using SP 800-53A procedures
  • Obtain authorization (ATO) based on residual risk
  • Continuously monitor controls and update plans of action and milestones (POA&M)

CIS Controls v8.1

CIS Critical Security Controls, Version 8.1

Framework Voluntary Global

The CIS Critical Security Controls are a prioritised set of 18 controls and 153 safeguards that defend against the most common cyberattacks. Safeguards are grouped into three Implementation Groups: IG1 (56 safeguards, essential cyber hygiene for every organisation), IG2 and IG3 for more complex environments. Version 8.1, released in June 2024, aligned the controls with NIST CSF 2.0. They are free, practical and ideal as a first baseline for small IT companies.

Covers, who needs it and key requirements
What it covers
Asset and software inventory, data protection, secure configuration, account and access management, vulnerability management, audit logs, email and browser protection, malware defences, data recovery, network monitoring, security awareness, service provider management, application security, incident response and penetration testing.
Who needs it
Any organisation, especially small and mid-sized IT companies that need a practical, prioritised security baseline.
Why it matters
It turns security into an ordered to-do list based on real attack data, and IG1 is a realistic starting point that also satisfies many insurer and client questionnaires.
Applies in
Worldwide
Key requirements
  • Inventory and control enterprise assets and software (Controls 1 and 2)
  • Data protection and secure configuration (Controls 3 and 4)
  • Account management and access control, including MFA (Controls 5 and 6)
  • Continuous vulnerability management and audit log management (Controls 7 and 8)
  • Malware defences, data recovery and network defences (Controls 9 to 13)
  • Awareness training, service providers, application security, incident response and pen testing (Controls 14 to 18)

FedRAMP

Federal Risk and Authorization Management Program

Government authorization Mandatory if in scope US federal

FedRAMP is the US government programme that standardises security assessment and authorization of cloud products used by federal agencies. Cloud service providers implement a NIST SP 800-53 baseline (Low, Moderate or High), are assessed by an accredited third-party assessment organisation (3PAO), and receive an authorization listed on the FedRAMP Marketplace, followed by continuous monitoring. FedRAMP 20x, launched in 2025, is replacing document-heavy Rev. 5 packages with automated, machine-readable evidence.

Covers, who needs it and key requirements
What it covers
Cloud service offerings (IaaS, PaaS, SaaS) used by federal agencies: security baselines, system security plan, 3PAO assessment, authorization, continuous monitoring, incident reporting and significant change management.
Who needs it
SaaS, PaaS and IaaS providers that sell, or want to sell, to US federal agencies, and their subcontractors handling federal data.
Why it matters
Agencies cannot use a cloud service without it, and a FedRAMP authorization is reused across agencies and trusted by state governments and regulated industries.
Applies in
United States (federal)
Key requirements
  • Choose an impact level (Low, Moderate, High) based on FIPS 199 categorisation
  • Implement the FedRAMP baseline controls from NIST SP 800-53 Rev. 5
  • Document the system security plan and boundary (or 20x key security indicators)
  • Independent assessment by an accredited 3PAO
  • Authorization by an agency or the FedRAMP Board
  • Continuous monitoring: monthly vulnerability scanning, POA&M updates and annual assessments

OWASP Top 10

OWASP Top 10:2025 The Ten Most Critical Web Application Security Risks

Awareness standard Voluntary Global

The OWASP Top 10 is the most widely used awareness list of critical web application security risks, published by the non-profit OWASP Foundation from vulnerability data and community surveys. The 2025 edition, released in November 2025, ranks Broken Access Control first, adds Software Supply Chain Failures (A03) and Mishandling of Exceptional Conditions (A10), and folds SSRF into access control. It is a starting point for secure coding, testing and developer training, not a complete standard.

Covers, who needs it and key requirements
What it covers
A01 Broken Access Control, A02 Security Misconfiguration, A03 Software Supply Chain Failures, A04 Cryptographic Failures, A05 Injection, A06 Insecure Design, A07 Authentication Failures, A08 Software or Data Integrity Failures, A09 Security Logging and Alerting Failures, A10 Mishandling of Exceptional Conditions.
Who needs it
Software development companies, web and app agencies, SaaS teams, QA and penetration testing providers, and any team building web applications or APIs.
Why it matters
Clients, PCI DSS assessors and pen testers use it as the baseline, so building and testing against it avoids the most common and most expensive application flaws.
Applies in
Worldwide
Key requirements
  • Enforce access control on the server for every request (A01)
  • Harden configurations and remove defaults (A02)
  • Manage dependencies, build pipelines and SBOMs (A03)
  • Use strong, current cryptography and protect secrets (A04)
  • Use parameterised queries and output encoding (A05) and threat-model designs (A06)
  • Strong authentication, integrity checks, logging with alerting, and safe error handling (A07 to A10)

COBIT

COBIT (Control Objectives for Information and Related Technologies) framework for the governance and management of enterprise IT

Framework Voluntary Global

COBIT is ISACA's framework for the governance and management of enterprise IT. It separates governance (evaluate, direct, monitor) from management (plan, build, run, monitor) and defines objectives such as managing risk, security, changes, suppliers and performance, with a capability scale and design factors to tailor the system. ISACA has announced COBIT 7 for launch in late October 2026; COBIT 2019, with its 40 objectives in five domains, is still the version most organisations have implemented.

Covers, who needs it and key requirements
What it covers
Governance objectives (EDM) and management objectives across Align, Plan and Organise (APO), Build, Acquire and Implement (BAI), Deliver, Service and Support (DSS) and Monitor, Evaluate and Assess (MEA), plus components such as processes, structures, information flows and skills.
Who needs it
Boards, CIOs and IT auditors in mid-sized and large organisations, banks and regulated entities, and IT service providers supporting their governance or audit.
Why it matters
It links IT to business goals and gives auditors and regulators a recognised yardstick for IT control.
Applies in
Worldwide
Key requirements
  • Understand enterprise strategy and goals and map them to IT-related goals (goals cascade)
  • Use design factors to tailor the governance system
  • Define roles and governance structures (board, IT steering committee)
  • Implement prioritised objectives such as managed risk, security, change and service requests
  • Measure process capability and performance
  • Monitor, evaluate and report on governance to the board

ITIL

ITIL (formerly IT Infrastructure Library) IT and digital service management framework

Framework Voluntary Global

ITIL is the most widely used framework for IT service management. ITIL 4 describes a service value system and 34 management practices, such as incident management, change enablement, problem management, service desk and service level management, that help IT teams deliver reliable services. PeopleCert began rolling out ITIL Version 5 in 2026, with ITIL 4 running alongside it. ITIL itself is not certifiable for organisations; ISO/IEC 20000-1 is the matching certifiable standard.

Covers, who needs it and key requirements
What it covers
Service management principles, the service value chain, governance, continual improvement and practices for incident, problem, change, service request, service desk, service level, configuration, release, deployment, monitoring and supplier management.
Who needs it
Managed service providers, IT outsourcing and support companies, internal IT departments and SaaS operations teams.
Why it matters
Clients use ITIL language in contracts and SLAs, and consistent practices reduce outages and improve customer satisfaction.
Applies in
Worldwide
Key requirements
  • Adopt the guiding principles and define value streams for your services
  • Service desk and incident management with priorities and SLAs
  • Change enablement with risk-based approvals
  • Problem management to remove root causes
  • Service level management and reporting to customers
  • Continual improvement using measurable objectives

FISMA

Federal Information Security Modernization Act of 2014 (originally the Federal Information Security Management Act of 2002)

Law Mandatory if in scope US federal

FISMA is the US federal law that requires every federal agency to run an agency-wide information security programme, including for systems operated by contractors. Agencies categorise systems, apply NIST SP 800-53 controls under the Risk Management Framework, authorize systems to operate, continuously monitor them and report annually to OMB and Congress. IT companies meet FISMA through contract clauses when they build, host or operate systems for federal agencies.

Covers, who needs it and key requirements
What it covers
Federal information and information systems, including those run by contractors: risk-based security programmes, system categorisation, security controls, authorization, continuous monitoring, incident reporting to CISA and annual reporting.
Who needs it
US federal agencies and the IT contractors, integrators and cloud providers that operate systems or process information on their behalf.
Why it matters
Federal contracts flow FISMA duties down to vendors; without an ATO a system cannot go live.
Applies in
United States (federal)
Key requirements
  • Inventory information systems and categorise them (FIPS 199)
  • Select and implement NIST SP 800-53 controls (FIPS 200 minimum requirements)
  • Write a system security plan and assess controls
  • Obtain an Authorization to Operate from the authorizing official
  • Continuously monitor and report incidents to CISA
  • Annual independent evaluation and FISMA reporting to OMB

SOX

Sarbanes-Oxley Act of 2002 (IT general controls under Sections 302 and 404)

Law Mandatory if in scope US-listed companies

The Sarbanes-Oxley Act requires US-listed companies to certify their financial reports and maintain effective internal control over financial reporting (ICFR). Section 302 makes the CEO and CFO certify each report, and Section 404 requires an annual management assessment of ICFR, with auditor attestation for larger filers. For IT, this means tested IT general controls (ITGCs) over access, change management and operations for every system that affects the financial statements.

Covers, who needs it and key requirements
What it covers
Internal control over financial reporting, including IT general controls over financial systems (ERP, billing, payroll, data warehouses), application controls, access, change management, computer operations and outsourced service providers.
Who needs it
SEC-registered public companies and companies preparing for a US IPO, plus the SaaS, ERP, payroll and managed IT providers whose systems support their financial reporting.
Why it matters
IT control failures can become material weaknesses that must be disclosed to investors, and listed clients will ask vendors for SOC 1 reports and evidence.
Applies in
United States; applies to SEC-registered companies worldwide
Key requirements
  • Scope financially significant applications and supporting infrastructure
  • Logical access controls: provisioning, periodic reviews, privileged access, segregation of duties
  • Change management: approval, testing and segregation for changes to in-scope systems
  • Computer operations: job scheduling, backups, incident management
  • Obtain and review SOC 1 reports for outsourced services, including complementary user entity controls
  • Document, test and remediate controls each year for management's assessment and the auditor

ISO 22301

ISO 22301:2019 Security and resilience: Business continuity management systems (BCMS) requirements

Certifiable standard Voluntary Global

ISO 22301 sets requirements for a business continuity management system (BCMS) that helps an organisation keep delivering critical products and services during disruption and recover them within agreed times. It requires a business impact analysis, risk assessment, continuity strategies and solutions, documented plans, regular exercises and testing, and management review. It is voluntary and certifiable, and it is widely requested from IT service providers, data centres and BPOs.

Covers, who needs it and key requirements
What it covers
Context and scope, leadership, business impact analysis (BIA), risk assessment, business continuity strategies and solutions, plans and procedures, warning and communication, exercise programme, evaluation and improvement.
Who needs it
IT and managed service providers, data centres, SaaS platforms, BPOs, banks and any organisation whose clients depend on uninterrupted services.
Why it matters
It proves you can recover critical services within agreed RTOs and RPOs, which clients and regulators increasingly require.
Applies in
Worldwide (international standard)
Key requirements
  • Define scope and the products and services that must continue
  • Business impact analysis to set recovery time and point objectives (RTO, RPO, MTPD)
  • Risk assessment of disruptions
  • Business continuity strategies, resources and documented plans
  • Exercise and test plans regularly and record results
  • Evaluate performance, run internal audits and management reviews, and improve

ISO 42001

ISO/IEC 42001:2023 Information technology: Artificial intelligence: Management system (AIMS)

Certifiable standard Voluntary Global

ISO/IEC 42001 is the first international standard for an artificial intelligence management system (AIMS). It helps organisations that develop, provide or use AI systems set AI policy and objectives, assess AI risks and the impact of AI systems on people and society, and control the AI lifecycle through 38 Annex A controls covering data, transparency, human oversight, third parties and responsible use. It follows the same structure as ISO 27001 and is voluntary and certifiable.

Covers, who needs it and key requirements
What it covers
AI policy and roles, AI risk assessment and treatment, AI system impact assessment, data for AI systems, AI lifecycle (design, verification, deployment, monitoring), information for interested parties, third-party and customer relationships, and continual improvement.
Who needs it
AI product companies, SaaS vendors adding AI features, IT service providers building AI solutions for clients, and enterprises deploying AI in decisions that affect people.
Why it matters
Enterprise buyers and regulators want evidence of responsible AI governance, and it gives a recognised, auditable structure aligned with the EU AI Act and the NIST AI RMF.
Applies in
Worldwide (international standard)
Key requirements
  • Determine your AI roles (developer, provider, user) and AIMS scope
  • AI policy, objectives and accountable roles
  • AI risk assessment and treatment with a Statement of Applicability
  • AI system impact assessments for individuals, groups and society
  • Lifecycle controls for data quality, documentation, transparency, human oversight and monitoring
  • Internal audit, management review and continual improvement

ISO 27017

ISO/IEC 27017:2015 Code of practice for information security controls based on ISO/IEC 27002 for cloud services

Certifiable standard Voluntary Global

ISO/IEC 27017 adds cloud-specific guidance to the ISO 27002 controls and seven extra controls for cloud service providers and customers, such as shared roles and responsibilities, removal of customer assets, segregation in virtual environments, virtual machine hardening and monitoring of cloud services. It is usually assessed as an extension to an ISO 27001 certification and shows customers how a cloud or SaaS provider splits security responsibilities with them.

Covers, who needs it and key requirements
What it covers
Cloud-specific implementation guidance for ISO 27002 controls and additional controls on shared responsibility, customer asset removal, tenant segregation, administrator operations and cloud monitoring.
Who needs it
Cloud service providers, SaaS vendors and managed hosting providers, and enterprise cloud customers.
Why it matters
It answers the shared-responsibility questions cloud customers ask and strengthens an ISO 27001 certificate for cloud services.
Applies in
Worldwide (international standard)
Key requirements
  • Document shared roles and responsibilities between provider and customer
  • Segregate customer environments in shared virtual infrastructure
  • Harden virtual machines and protect administrative operations
  • Return or securely remove customer assets at contract end
  • Give customers the ability to monitor relevant cloud activity

ISO 27018

ISO/IEC 27018:2025 Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors

Certifiable standard Voluntary Global

ISO/IEC 27018 sets privacy controls for public cloud providers that process personal data on behalf of customers. It covers processing only on customer instructions, transparency about sub-processors and data locations, support for data subject requests, return and deletion of data, breach notification and restrictions on using customer data for marketing. A new edition was published in 2025. It is usually certified alongside ISO 27001 and helps cloud vendors meet GDPR processor duties.

Covers, who needs it and key requirements
What it covers
Public cloud PII processing: customer instructions, consent and purpose limits, transparency, sub-processor disclosure, data location, return and deletion, breach notification and audit rights.
Who needs it
Public cloud, SaaS and hosting providers that process customer personal data.
Why it matters
It is a recognised way for cloud processors to show privacy controls to customers and regulators.
Applies in
Worldwide (international standard)
Key requirements
  • Process PII only on documented customer instructions
  • Disclose sub-processors and processing locations
  • Support customers with data subject requests
  • Notify customers of breaches involving their PII
  • Return or delete PII at the end of the contract

ISO 20000-1

ISO/IEC 20000-1:2018 Information technology: Service management: Part 1: Service management system requirements

Certifiable standard Voluntary Global

ISO/IEC 20000-1 is the certifiable international standard for an IT service management system. It requires a planned and governed approach to designing, delivering and improving services, including service level management, incident and request handling, problem management, change and release management, capacity, availability and continuity, supplier management and reporting. It is the organisational certificate that matches ITIL practices, and is often required in managed services and outsourcing tenders.

Covers, who needs it and key requirements
What it covers
Service management system context, leadership, planning, service portfolio, relationship and agreement management, supply and demand, service design and transition, resolution and fulfilment, assurance and improvement.
Who needs it
Managed service providers, IT outsourcing companies, data centres and internal IT departments.
Why it matters
It proves mature, repeatable service delivery to clients and is a common tender requirement for managed IT services.
Applies in
Worldwide (international standard)
Key requirements
  • Define the SMS scope and service management policy
  • Service level management and catalogue of services
  • Incident, request and problem management
  • Change, release and deployment management
  • Capacity, availability, continuity and supplier management

SOC 1

SOC 1 report on a service organisation's controls relevant to user entities' internal control over financial reporting (SSAE 18, AT-C 320)

Attestation report Voluntary US / global

A SOC 1 report is an independent CPA examination of a service organisation's controls that are relevant to its customers' financial reporting. Payroll, billing, payments, ERP hosting and fund administration providers commonly need one so that their public-company clients and their auditors can rely on the service for SOX. Like SOC 2 it comes as Type I (design) or Type II (operating effectiveness over a period), and it lists complementary controls the customer must operate.

Covers, who needs it and key requirements
What it covers
Control objectives over transaction processing and supporting IT general controls (access, change management, operations) at a service organisation.
Who needs it
SaaS and outsourcing providers whose services affect clients' financial statements, such as payroll, billing, payments and ERP hosting.
Why it matters
Listed clients and their auditors need it to rely on your service for SOX and financial audits.
Applies in
United States origin; used worldwide (ISAE 3402 is the international equivalent)
Key requirements
  • Define control objectives relevant to customers' financial reporting
  • Document the system and complementary user entity controls
  • Operate ITGCs over access, change and operations
  • Undergo a Type I or Type II examination by a CPA firm

CSA STAR

Cloud Security Alliance Security, Trust, Assurance and Risk (STAR) programme and Cloud Controls Matrix (CCM)

Certifiable standard Voluntary Global

CSA STAR is the Cloud Security Alliance's public registry and assurance programme for cloud providers, built on the Cloud Controls Matrix (CCM), a cloud-specific control framework now at version 4.1. Level 1 is a free self-assessment published in the registry using the Consensus Assessments Initiative Questionnaire (CAIQ). Level 2 adds third-party validation, either STAR Certification (with ISO 27001) or STAR Attestation (with SOC 2). It helps SaaS vendors answer cloud security questionnaires publicly.

Covers, who needs it and key requirements
What it covers
Cloud Controls Matrix domains such as application security, data security, identity and access, encryption, logging, supply chain and threat management.
Who needs it
SaaS, PaaS and IaaS providers that want public, standardised cloud security transparency.
Why it matters
A public STAR entry and CAIQ answers reduce one-off security questionnaires and map to ISO 27001 and SOC 2.
Applies in
Worldwide
Key requirements
  • Complete the CAIQ against the Cloud Controls Matrix
  • Publish a Level 1 self-assessment in the STAR Registry
  • For Level 2, combine with an ISO 27001 certification or SOC 2 attestation
  • Keep the registry entry current

NIS2 Directive

Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2)

Law Mandatory if in scope EU

NIS2 is the EU's cybersecurity law for essential and important entities in 18 sectors, including digital infrastructure, cloud and data centre providers, managed service and managed security service providers, and many manufacturers. Member states had to transpose it by 17 October 2024. In-scope entities must take risk management measures, report significant incidents (early warning within 24 hours, notification within 72 hours, final report within a month) and hold management accountable. Fines reach EUR 10 million or 2% of turnover.

Covers, who needs it and key requirements
What it covers
Cybersecurity risk management measures, supply chain security, incident reporting, management body accountability, registration and supervision for essential and important entities.
Who needs it
Medium and large entities in listed sectors operating in the EU, including cloud, data centre, DNS, managed service and managed security service providers.
Why it matters
Managed service providers are directly in scope, and in-scope clients pass NIS2 security requirements to their IT suppliers.
Applies in
European Union, through national transposition laws
Key requirements
  • Determine whether you are an essential or important entity in each member state
  • Implement the risk management measures in Article 21, including supply chain security
  • Report significant incidents within 24 hours, 72 hours and one month
  • Train management bodies and make them approve and oversee measures
  • Register with national authorities where required

DORA

Digital Operational Resilience Act, Regulation (EU) 2022/2554

Law Mandatory if in scope EU

DORA is the EU regulation on digital operational resilience for the financial sector, applying since 17 January 2025 to banks, insurers, investment firms, payment and crypto-asset providers and others. It requires an ICT risk management framework, classification and reporting of major ICT incidents, resilience testing including threat-led penetration testing for some firms, and strict management of ICT third-party risk with mandatory contract terms. Critical ICT third-party providers are directly overseen by EU supervisors.

Covers, who needs it and key requirements
What it covers
ICT risk management, ICT incident management and reporting, digital operational resilience testing, ICT third-party risk and contracts, information sharing and oversight of critical ICT providers.
Who needs it
EU financial entities, and the IT, cloud and software providers that serve them through contracts (critical providers are overseen directly).
Why it matters
Financial clients must put DORA contract terms, audit rights and exit plans into every ICT service agreement, so their vendors must comply in practice.
Applies in
European Union
Key requirements
  • ICT risk management framework approved by the management body
  • Classify and report major ICT-related incidents
  • Regular resilience testing, with TLPT for significant entities
  • Register of information on ICT third-party arrangements
  • Contracts with the mandatory provisions of Article 30, including exit strategies

Cyber Resilience Act

Cyber Resilience Act, Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements

Law Mandatory if in scope EU

The Cyber Resilience Act sets cybersecurity requirements for hardware and software products with digital elements sold in the EU. Manufacturers must design products securely, handle vulnerabilities for the support period, provide security updates and an SBOM, and carry out conformity assessment and CE marking. Reporting of actively exploited vulnerabilities and severe incidents has applied since 11 September 2026; the main requirements apply from 11 December 2027. Fines reach EUR 15 million or 2.5% of turnover.

Covers, who needs it and key requirements
What it covers
Security by design, vulnerability handling, security updates, SBOMs, technical documentation, conformity assessment, CE marking and reporting of exploited vulnerabilities and incidents for products with digital elements.
Who needs it
Manufacturers, importers and distributors of software and connected products placed on the EU market, including software companies selling licensed products. Pure SaaS is mostly covered by NIS2 instead.
Why it matters
It makes secure development and vulnerability handling a legal condition for selling software and connected products in the EU.
Applies in
European Union; applies to products placed on the EU market from anywhere
Key requirements
  • Meet the essential cybersecurity requirements in Annex I
  • Vulnerability handling for the support period, with an SBOM
  • Report actively exploited vulnerabilities and severe incidents (early warning within 24 hours)
  • Conformity assessment and CE marking before placing on the market
  • Technical documentation and user security information

EU Data Act

Data Act, Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data

Law Mandatory if in scope EU

The EU Data Act, applying since 12 September 2025, gives users of connected products and related services rights to access and share the data they generate, limits unfair data-sharing terms in contracts, and makes cloud and other data processing service providers support customer switching and remove switching charges in stages (fully by 12 January 2027). It also sets safeguards against unlawful non-EU government access to non-personal data held in the EU.

Covers, who needs it and key requirements
What it covers
Access to IoT and related service data, B2B contract fairness, public sector access in emergencies, cloud switching and interoperability, and international data safeguards.
Who needs it
Makers of connected products and related services, and cloud, SaaS and data processing service providers with EU customers.
Why it matters
Cloud and SaaS providers must support switching and data export, which changes contracts and product design.
Applies in
European Union
Key requirements
  • Make product and service data accessible to users
  • Support customer switching and data portability for data processing services
  • Phase out switching and egress charges by 12 January 2027
  • Avoid unfair data-sharing terms in B2B contracts
  • Protect non-personal data from unlawful third-country access

UK GDPR

UK General Data Protection Regulation and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025

Law Mandatory by law United Kingdom

The UK GDPR and the Data Protection Act 2018 form the UK's data protection law after Brexit. They closely follow the EU GDPR but are enforced by the Information Commissioner's Office. The Data (Use and Access) Act 2025 amends them in stages, for example on recognised legitimate interests, automated decision-making, cookies and complaints. Companies outside the UK that offer services to people in the UK or monitor them must comply, and fines reach GBP 17.5 million or 4% of turnover.

Covers, who needs it and key requirements
What it covers
Personal data of people in the UK: principles, lawful bases, rights, controller and processor duties, international transfers (UK IDTA and addendum), breach reporting and PECR rules on cookies and marketing.
Who needs it
UK companies and non-UK companies with UK users or clients, including processors serving UK clients.
Why it matters
UK clients require UK GDPR terms and transfer safeguards, and the ICO enforces it independently of the EU.
Applies in
United Kingdom; extraterritorial for organisations targeting or monitoring people in the UK
Key requirements
  • Lawful basis and transparency for processing
  • Data subject rights within one month
  • Breach reporting to the ICO within 72 hours where required
  • UK transfer mechanisms (IDTA or Addendum) for restricted transfers
  • A UK representative if you have no UK establishment but are in scope

Cyber Essentials

Cyber Essentials and Cyber Essentials Plus (UK government-backed certification scheme)

Certifiable standard Mandatory if in scope United Kingdom

Cyber Essentials is a UK government-backed certification, run by the National Cyber Security Centre with IASME as delivery partner, that proves five basic technical controls: firewalls, secure configuration, user access control, malware protection and security update management. The basic level is a verified self-assessment; Cyber Essentials Plus adds hands-on technical testing. It is required for many UK central government contracts that involve personal data or certain ICT services.

Covers, who needs it and key requirements
What it covers
Five technical controls applied to internet-connected devices, servers, cloud services and users in scope.
Who needs it
Suppliers to UK government and many UK businesses, including IT and software companies with UK public sector clients.
Why it matters
It is a low-cost entry to UK public sector work and blocks most common internet-based attacks.
Applies in
United Kingdom
Key requirements
  • Boundary firewalls and internet gateways
  • Secure configuration of devices and software
  • User access control, including MFA for cloud services
  • Malware protection
  • Security update management within 14 days for high and critical fixes

CMMC 2.0

Cybersecurity Maturity Model Certification 2.0 (US Department of Defense / Department of War)

Certifiable standard Mandatory if in scope US defence

CMMC is the US defence department's programme for verifying that contractors protect Federal Contract Information and Controlled Unclassified Information. Level 1 covers 15 basic safeguards, Level 2 the 110 requirements of NIST SP 800-171, and Level 3 adds selected SP 800-172 requirements. Phase 1 (self-assessments) began on 10 November 2025. In July 2026 the department paused Phase 2, which would have made third-party Level 2 assessments mandatory from 10 November 2026, pending a review.

Covers, who needs it and key requirements
What it covers
Protection of Federal Contract Information and Controlled Unclassified Information in contractor systems, with self, third-party (C3PAO) or government assessments by level.
Who needs it
US defence contractors and subcontractors at every tier, including software and IT service suppliers handling FCI or CUI.
Why it matters
Defence contracts can require a CMMC status as a condition of award; the rules remain in place even while Phase 2 is paused.
Applies in
United States (defence contracts)
Key requirements
  • Identify FCI and CUI and the systems that handle them
  • Implement FAR 52.204-21 (Level 1) or NIST SP 800-171 (Level 2) requirements
  • Complete the required self or third-party assessment and affirm in SPRS
  • Maintain a System Security Plan and POA&M
  • Keep watching the Phase 2 status for contract requirements

NIST SP 800-171

NIST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Framework Mandatory if in scope US federal contracts

NIST SP 800-171 defines the security requirements contractors must meet to protect Controlled Unclassified Information (CUI) in their own systems. Revision 3 (May 2024) has 97 requirements in 17 families, but US defence contracts continue to assess against the 110 requirements of Revision 2 under a class deviation, including for CMMC Level 2. It is required through DFARS 252.204-7012 and other federal contract clauses.

Covers, who needs it and key requirements
What it covers
Access control, awareness, audit, configuration, identification and authentication, incident response, maintenance, media, personnel, physical, risk, security assessment, system and communications protection, and system integrity for CUI.
Who needs it
US federal and defence contractors and subcontractors that store, process or transmit CUI.
Why it matters
It is a contractual condition for handling CUI and the basis of CMMC Level 2.
Applies in
United States (federal contracts)
Key requirements
  • Scope systems that handle CUI
  • Implement the 800-171 requirements (Rev. 2 for current DoD assessments)
  • Document a System Security Plan and plans of action
  • Report a self-assessment score in SPRS where DFARS 252.204-7019 applies
  • Report cyber incidents to DoD within 72 hours (DFARS 252.204-7012)

NIST SSDF (SP 800-218)

NIST SP 800-218 Secure Software Development Framework (SSDF) Version 1.1

Framework Mandatory if in scope US / global

The Secure Software Development Framework (NIST SP 800-218) is a set of high-level secure development practices grouped into four areas: prepare the organisation, protect the software, produce well-secured software, and respond to vulnerabilities. Software producers selling to US federal agencies attest to it through the CISA secure software development attestation form. Version 1.1 is final, and NIST published a draft Version 1.2 in December 2025.

Covers, who needs it and key requirements
What it covers
Secure development policies and roles, protecting code and build environments, secure design, code review and testing, provenance and SBOM practices, and vulnerability response.
Who needs it
Software producers selling to US federal agencies, and any software company wanting a recognised secure SDLC framework.
Why it matters
Federal buyers require attestation to it, and it maps to the EU Cyber Resilience Act and client secure development questionnaires.
Applies in
United States origin; used worldwide
Key requirements
  • Prepare the organisation (PO): roles, training, toolchains
  • Protect the software (PS): code integrity, provenance, archived releases
  • Produce well-secured software (PW): design, review, testing, secure defaults
  • Respond to vulnerabilities (RV): identify, analyse and fix root causes

OWASP ASVS

OWASP Application Security Verification Standard 5.0

Framework Voluntary Global

The OWASP Application Security Verification Standard gives testable security requirements for web applications and services, organised in three levels of rigour. Version 5.0, released in May 2025, restructured the requirements and is widely used to define what a secure application must do, to scope penetration tests and to write security acceptance criteria in development contracts. Where the OWASP Top 10 lists risks, ASVS says how to verify that controls are in place.

Covers, who needs it and key requirements
What it covers
Verification requirements for architecture, authentication, session management, access control, validation, cryptography, error handling, data protection, communications, configuration and APIs.
Who needs it
Development teams, software companies, QA and penetration testers, and clients writing security requirements into contracts.
Why it matters
It turns secure coding into measurable acceptance criteria and test cases.
Applies in
Worldwide
Key requirements
  • Choose a verification level (L1, L2 or L3) per application
  • Use ASVS requirements as security user stories and acceptance criteria
  • Verify with code review, automated tests and penetration testing
  • Track and fix gaps before release

WCAG 2.2

Web Content Accessibility Guidelines (WCAG) 2.2

Framework Mandatory if in scope Global

WCAG 2.2 is the W3C standard for making web content and apps accessible to people with disabilities, published as a W3C Recommendation in October 2023. Its success criteria are grouped under four principles (perceivable, operable, understandable, robust) at levels A, AA and AAA. Level AA is the benchmark referenced by laws and procurement rules such as the European Accessibility Act (through EN 301 549), US Section 508 and ADA settlements, and Indian government guidelines.

Covers, who needs it and key requirements
What it covers
Text alternatives, captions, adaptable and distinguishable content, keyboard access, timing, navigation, input modalities, readable and predictable interfaces, and compatibility with assistive technologies.
Who needs it
Software and web development companies, SaaS and e-commerce businesses, and anyone selling digital products to public bodies or consumers in regulated markets.
Why it matters
Accessibility is now a legal requirement for many digital products and a common tender requirement.
Applies in
Worldwide; legally referenced in the EU, US, UK, India and elsewhere
Key requirements
  • Meet WCAG 2.2 Level AA success criteria
  • Test with automated tools and manual keyboard and screen reader checks
  • Publish an accessibility statement
  • Fix issues found and test new releases

European Accessibility Act

European Accessibility Act, Directive (EU) 2019/882 on the accessibility requirements for products and services

Law Mandatory if in scope EU

The European Accessibility Act requires listed products and services sold in the EU to be accessible to people with disabilities, applying since 28 June 2025. It covers e-commerce, consumer banking, e-books, electronic communications, transport ticketing, computers, smartphones, self-service terminals and their software. In practice websites and apps are expected to meet EN 301 549, which incorporates WCAG Level AA. Micro-enterprises providing services are exempt.

Covers, who needs it and key requirements
What it covers
Accessibility requirements for listed products and services, including websites and mobile apps for e-commerce and banking, plus documentation and conformity duties.
Who needs it
Businesses selling covered products or services to EU consumers, and the agencies and software firms that build their websites and apps.
Why it matters
EU clients now need accessible websites and apps by law, so development contracts include accessibility requirements.
Applies in
European Union, through national laws
Key requirements
  • Check whether your product or service is in scope
  • Meet the accessibility requirements, usually via EN 301 549 / WCAG AA
  • Provide accessibility information about the service
  • Monitor and fix accessibility issues

HITRUST CSF

HITRUST Common Security Framework and e1, i1 and r2 assessments

Certifiable standard Voluntary US healthcare

HITRUST is a certifiable security and privacy framework widely used by US healthcare organisations and their vendors. The HITRUST CSF harmonises requirements from HIPAA, NIST, ISO and others, and offers three assessment levels: e1 (essential, one year), i1 (implemented, one year) and r2 (risk-based, two years). Assessments are performed by authorised external assessors and quality-checked by HITRUST before certification.

Covers, who needs it and key requirements
What it covers
A harmonised control framework covering information protection, access control, risk management, endpoint and network protection, incident management and privacy, mapped to HIPAA and other standards.
Who needs it
Health tech, healthcare SaaS, revenue cycle and IT vendors serving US hospitals and payers.
Why it matters
Many US health systems and payers ask vendors for HITRUST certification as proof of HIPAA-aligned security.
Applies in
United States origin; used mainly in US healthcare
Key requirements
  • Choose an assessment level (e1, i1 or r2)
  • Scope systems and implement the selected requirements
  • Readiness assessment and remediation
  • Validated assessment by an authorised assessor and HITRUST QA

21 CFR Part 11

US FDA 21 CFR Part 11: Electronic Records; Electronic Signatures

Regulation Mandatory if in scope US life sciences

21 CFR Part 11 sets the FDA's criteria for when electronic records and signatures are trustworthy and equivalent to paper. It applies to records required under FDA rules, such as clinical trial, manufacturing and quality records. Systems need validation, secure audit trails, access controls, record retention and controls on electronic signatures. Software companies serving pharmaceutical, biotech and medical device clients must support Part 11 and GxP validation.

Covers, who needs it and key requirements
What it covers
Validation, audit trails, record protection and retention, access and authority checks, device checks, training, signature manifestations and signature-record linking.
Who needs it
Life sciences companies and the software and SaaS vendors whose systems hold FDA-required records.
Why it matters
FDA inspectors check Part 11 controls, and pharma clients require vendor support for validation.
Applies in
United States (FDA-regulated activities); relied on worldwide by life sciences
Key requirements
  • Validate systems for accuracy and reliability
  • Secure, computer-generated, time-stamped audit trails
  • Limit system access to authorised individuals
  • Electronic signatures linked to records and unique to each person
  • Retain records and make them available for inspection

NIST AI RMF

NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0)

Framework Voluntary US / global

The NIST AI Risk Management Framework (January 2023) is a voluntary framework for managing risks of AI systems across their lifecycle. It defines characteristics of trustworthy AI and four functions: Govern, Map, Measure and Manage. NIST's Generative AI Profile (NIST AI 600-1, July 2024) applies it to generative AI risks such as confabulation, data privacy and information integrity. It is often used alongside ISO/IEC 42001 and the EU AI Act.

Covers, who needs it and key requirements
What it covers
Trustworthy AI characteristics (valid, reliable, safe, secure, accountable, explainable, privacy-enhanced, fair), and the Govern, Map, Measure and Manage functions.
Who needs it
Organisations developing or deploying AI, especially those selling to US clients or government.
Why it matters
It gives a free, widely recognised structure for AI risk that maps to ISO 42001 and AI laws.
Applies in
United States origin; used worldwide
Key requirements
  • Govern: policies, roles and culture for AI risk
  • Map: context, intended use and impacts of each AI system
  • Measure: test and track AI risks and trustworthiness
  • Manage: prioritise and treat risks and monitor deployed systems

India AI Governance Guidelines

India AI Governance Guidelines (MeitY / IndiaAI Mission, November 2025)

Framework Voluntary India

Released by MeitY in November 2025, the India AI Governance Guidelines set out a principle-based, innovation-first approach to AI rather than a new AI law. They propose relying on existing laws such as the IT Act and DPDP Act, voluntary measures and techno-legal tools, and new institutions for coordination. For companies they recommend grievance mechanisms, transparency, risk assessments and voluntary frameworks. Binding duties for AI content currently come from the IT Rules amendments of February 2026.

Covers, who needs it and key requirements
What it covers
Governance principles, institutional framework, risk classification approach, voluntary commitments, techno-legal measures and how existing laws apply to AI.
Who needs it
AI developers and deployers in India, and IT companies building AI products for the Indian market.
Why it matters
It signals how Indian regulators will judge AI governance, and pairs with binding IT Rules duties on synthetic content.
Applies in
India
Key requirements
  • Map AI use against existing Indian laws (IT Act, DPDP Act, consumer and sector rules)
  • Set up grievance redressal for AI-affected users
  • Adopt transparency and risk assessment practices
  • Label synthetic content where the IT Rules require it

ISO 27031

ISO/IEC 27031:2025 Guidelines for ICT readiness for business continuity

Framework Voluntary Global

ISO/IEC 27031 gives guidance on ICT readiness for business continuity: making sure IT systems, networks and data can support the business through disruption. The 2025 edition updates the 2011 guidance on planning, implementing, testing and improving ICT continuity, including recovery strategies, resilience and dependencies on third parties and cloud services. It is guidance, not a certifiable requirement standard, and is used with ISO 22301 and ISO 27001.

Covers, who needs it and key requirements
What it covers
ICT continuity planning, recovery strategies, resilience, testing and exercising, performance monitoring and improvement.
Who needs it
IT departments, managed service providers, data centres and cloud teams responsible for recovery capabilities.
Why it matters
It turns business continuity requirements into concrete ICT recovery capabilities.
Applies in
Worldwide (international standard)
Key requirements
  • Identify ICT services supporting critical activities
  • Set ICT recovery objectives aligned to the BIA
  • Design resilience and recovery strategies
  • Test and exercise ICT recovery regularly

NIST SP 800-34

NIST SP 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems

Framework Mandatory if in scope US / global

NIST SP 800-34 is a practical guide to IT contingency planning. It describes a seven-step process: develop a policy, conduct a business impact analysis, identify preventive controls, create recovery strategies, develop the contingency plan, test and exercise it, and maintain it. Federal systems use it to meet the CP control family of SP 800-53, and many private IT teams use its templates for disaster recovery planning.

Covers, who needs it and key requirements
What it covers
Contingency planning policy, BIA, preventive controls, recovery strategies, plan development, testing, training and exercises, and plan maintenance.
Who needs it
IT teams writing disaster recovery and contingency plans, especially for US federal systems.
Why it matters
It gives a free, step-by-step method and templates for DR planning.
Applies in
United States (federal); used worldwide as guidance
Key requirements
  • Contingency planning policy
  • Business impact analysis
  • Recovery strategies and plans
  • Testing, training and exercises
  • Plan maintenance

ISO 31000

ISO 31000:2018 Risk management: Guidelines

Framework Voluntary Global

ISO 31000 provides principles, a framework and a process for managing any kind of risk. It is guidance, not a certifiable requirements standard. Many IT risk programmes use it as the overall method behind risk registers, risk appetite statements and treatment plans, while ISO 27005 applies it to information security risk.

Covers, who needs it and key requirements
What it covers
Risk management principles, framework (leadership, integration, design, implementation, evaluation, improvement) and process (identify, analyse, evaluate, treat, monitor, communicate).
Who needs it
Boards, risk and IT leaders who need a common risk method across the business.
Why it matters
It gives a consistent risk language that other standards plug into.
Applies in
Worldwide (international standard)
Key requirements
  • Integrate risk management into governance
  • Define risk criteria and appetite
  • Identify, analyse and evaluate risks
  • Treat, monitor and report risks

ISO/IEC 38500

ISO/IEC 38500:2024 Information technology: Governance of IT for the organization

Framework Voluntary Global

ISO/IEC 38500 gives boards and governing bodies principles for the effective, efficient and acceptable use of IT in their organisations. The 2024 edition sets out how governing bodies should evaluate, direct and monitor the use of IT and data. It is a short, high-level guidance standard that frameworks such as COBIT build on.

Covers, who needs it and key requirements
What it covers
Governance principles and the evaluate, direct and monitor model for IT and data use.
Who needs it
Boards, directors and executives responsible for IT governance.
Why it matters
It defines what good IT governance looks like at board level.
Applies in
Worldwide (international standard)
Key requirements
  • Assign responsibility for IT at board level
  • Evaluate current and future IT use
  • Direct strategy and policies
  • Monitor performance and conformance

SWIFT CSP

SWIFT Customer Security Programme and Customer Security Controls Framework (CSCF)

Industry standard Contractually required Global

The SWIFT Customer Security Programme requires every organisation connected to the SWIFT network to implement the mandatory controls of the Customer Security Controls Framework and attest each year, with independent assessment. The CSCF is updated annually and covers securing the local SWIFT environment, controlling access and detecting anomalous activity. IT providers that host or manage SWIFT infrastructure for banks must support these controls.

Covers, who needs it and key requirements
What it covers
Secure environment, access control, detection of anomalous activity and incident planning for SWIFT-connected infrastructure.
Who needs it
Banks and financial institutions on SWIFT, and IT and service bureaus hosting SWIFT components.
Why it matters
Attestation is mandatory for SWIFT users, and counterparties can see your status.
Applies in
Worldwide (SWIFT network users)
Key requirements
  • Identify your SWIFT architecture type
  • Implement all mandatory CSCF controls for your version
  • Independent assessment
  • Annual attestation in the KYC Security Attestation application

RBI IT Governance Directions

RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, 2023 (and Master Direction on Outsourcing of IT Services, 2023)

Regulation Mandatory if in scope India

The Reserve Bank of India's Master Direction on IT Governance, Risk, Controls and Assurance Practices (7 November 2023, effective 1 April 2024) requires banks, NBFCs and other regulated entities to have board-level IT governance, IT and information security risk management, business continuity, and IS audit. A separate Master Direction on Outsourcing of IT Services (April 2023) sets due diligence, contract, audit-rights and exit requirements that apply to IT vendors and cloud providers serving them.

Covers, who needs it and key requirements
What it covers
IT governance structures, IT strategy, information security, cyber risk, change and patch management, BCP and DR, IS audit, and outsourcing of IT services including cloud.
Who needs it
Banks, NBFCs, payment system operators and credit information companies regulated by RBI, and their IT and cloud vendors.
Why it matters
Indian financial clients must flow these requirements into vendor contracts and audits.
Applies in
India (RBI-regulated entities)
Key requirements
  • Board-approved IT strategy and IT governance committees
  • Information security policy, cyber risk management and SOC
  • BCP and DR with regular drills
  • Annual IS audit
  • Outsourcing risk assessment, contracts with audit rights and exit plans

SEBI CSCRF

SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities, 2024

Regulation Mandatory if in scope India

SEBI's Cybersecurity and Cyber Resilience Framework, issued on 20 August 2024 with phased compliance through 2025, sets cybersecurity standards for stock exchanges, depositories, brokers, mutual funds, investment advisers and other SEBI-regulated entities. It follows a graded approach by entity category and covers governance, identification, protection, detection, response, recovery and evolution, with cyber audits, a security operations centre for larger entities and incident reporting to CERT-In and SEBI.

Covers, who needs it and key requirements
What it covers
Cyber governance, asset and risk identification, protection controls, SOC and detection, incident response and reporting, recovery, audits and third-party (including cloud) risk.
Who needs it
SEBI-regulated entities and the IT, cloud and SaaS vendors that serve them.
Why it matters
Market entities must audit their vendors and include CSCRF requirements in contracts.
Applies in
India (SEBI-regulated entities)
Key requirements
  • Classify the entity category and applicable controls
  • Board-approved cybersecurity policy and governance
  • SOC or managed SOC as required
  • Periodic cyber audits by CERT-In empanelled auditors
  • Incident reporting to CERT-In and SEBI

IRDAI Cyber Security Guidelines

IRDAI Information and Cyber Security Guidelines, 2023

Regulation Mandatory if in scope India

The Insurance Regulatory and Development Authority of India's Information and Cyber Security Guidelines (April 2023) require insurers and insurance intermediaries to run an information security programme with a board-approved policy, a CISO, risk assessment, data classification, SOC monitoring, incident reporting within six hours in line with CERT-In, annual audits and controls over outsourced IT and cloud vendors.

Covers, who needs it and key requirements
What it covers
Governance, risk assessment, data security, access control, cloud and outsourcing, monitoring, incident response, audits and business continuity for insurers.
Who needs it
Insurers and insurance intermediaries in India and their IT service providers.
Why it matters
Insurers pass these controls to their IT vendors through contracts and audits.
Applies in
India (insurance sector)
Key requirements
  • Board-approved information and cyber security policy
  • CISO and information security committee
  • Incident reporting within 6 hours
  • Annual comprehensive cyber security audit
  • Vendor and cloud security controls

IT Rules 2021

Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended up to February 2026

Regulation Mandatory if in scope India

The IT Rules 2021 set the due diligence an intermediary (platforms, marketplaces, hosting and many SaaS services that host user content) must follow to keep safe harbour under Section 79 of the IT Act. They require published terms, a grievance officer, action on unlawful content within set timelines, and extra duties for significant social media intermediaries. Amendments in force from 20 February 2026 add labelling and provenance rules for synthetically generated content and a three-hour window for acting on government and court orders.

Covers, who needs it and key requirements
What it covers
Intermediary due diligence, grievance redressal, takedown timelines, synthetic content labelling, significant social media intermediary duties, and digital media ethics code.
Who needs it
Platforms, marketplaces, social media, hosting and SaaS services in India that host or transmit user content, and AI content tool providers.
Why it matters
Failing due diligence removes safe harbour and exposes the platform to liability for user content.
Applies in
India
Key requirements
  • Publish rules, privacy policy and user agreement
  • Appoint a grievance officer and resolve complaints within set timelines
  • Act on government or court orders within 3 hours (from February 2026)
  • Label synthetic content and keep provenance markers
  • Extra compliance officers and reports for significant social media intermediaries

SPDI Rules 2011

Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011

Regulation Mandatory by law India

The SPDI Rules 2011 under Section 43A of the IT Act are India's current data protection rules for sensitive personal data such as passwords, financial and health information and biometrics. They require a privacy policy, consent for collection, purpose limits, consent for disclosure and transfers, and reasonable security practices, with ISO/IEC 27001 named as one recognised standard. They will be replaced when the DPDP Act's main provisions start on 13 May 2027.

Covers, who needs it and key requirements
What it covers
Sensitive personal data or information: privacy policy, consent, collection limits, disclosure, transfers, grievance officer and reasonable security practices.
Who needs it
Body corporates in India that collect or handle sensitive personal data, including IT and BPO companies.
Why it matters
They are the data protection rules that apply today, until the DPDP Act takes over.
Applies in
India (until the DPDP Act's main provisions start on 13 May 2027)
Key requirements
  • Publish a privacy policy
  • Obtain written consent for collecting sensitive data
  • Use data only for the stated purpose and allow withdrawal
  • Implement reasonable security practices (for example ISO 27001)
  • Appoint a grievance officer

LGPD

Lei Geral de Proteção de Dados Pessoais (Brazil's General Data Protection Law), Law No. 13,709/2018

Law Mandatory by law Brazil

The LGPD is Brazil's comprehensive data protection law, in force since September 2020 with sanctions enforceable since August 2021 by the national authority ANPD. Modelled on the GDPR, it requires a legal basis for processing, transparency, data subject rights, security, a data protection officer (encarregado) and incident reporting. It applies to processing in Brazil and to companies abroad offering goods or services to people in Brazil. Fines reach 2% of Brazilian revenue, capped at BRL 50 million per infraction.

Covers, who needs it and key requirements
What it covers
Personal data processing in Brazil or of people in Brazil: legal bases, rights, controllers and processors, DPO, security, incident reporting and international transfers.
Who needs it
Companies with users or clients in Brazil, including foreign SaaS and IT providers.
Why it matters
Brazil is a large digital market and ANPD actively enforces the law.
Applies in
Brazil; extraterritorial for processing of data collected in Brazil or offering goods or services there
Key requirements
  • Legal basis for each processing activity
  • Appoint an encarregado (DPO)
  • Honour data subject rights
  • Report security incidents to ANPD and data subjects
  • Safeguards for international transfers

PIPL

Personal Information Protection Law of the People's Republic of China

Law Mandatory by law China

China's Personal Information Protection Law, in force since 1 November 2021, regulates personal information processing in China and processing abroad that targets people in China. It requires a legal basis (often separate consent), notices, impact assessments for sensitive data and transfers, local representatives for foreign processors, and strict cross-border transfer mechanisms such as CAC security assessments, standard contracts or certification. Fines reach CNY 50 million or 5% of the previous year's turnover.

Covers, who needs it and key requirements
What it covers
Personal information processing, sensitive information, cross-border transfers, individual rights, processor duties, and obligations for large platforms.
Who needs it
Companies processing personal information of people in China, including foreign SaaS and IT providers serving Chinese users.
Why it matters
Cross-border transfer rules can block data flows without the right mechanism.
Applies in
China; extraterritorial for processing of personal information of people in China
Key requirements
  • Legal basis and separate consent where required
  • Personal information protection impact assessments
  • Cross-border transfer mechanism (CAC assessment, standard contract or certification)
  • Local representative for foreign processors
  • Honour individual rights

PIPEDA

Personal Information Protection and Electronic Documents Act (Canada)

Law Mandatory by law Canada

PIPEDA is Canada's federal private-sector privacy law. It applies to organisations that collect, use or disclose personal information in commercial activities, built around ten fair information principles including accountability, consent, limiting use and safeguards. Breaches that create a real risk of significant harm must be reported to the Privacy Commissioner and affected individuals. Quebec's Law 25, Alberta and British Columbia have their own laws for local private-sector activity.

Covers, who needs it and key requirements
What it covers
Ten fair information principles, consent, access and correction, safeguards, breach reporting and record keeping.
Who needs it
Organisations handling personal information of Canadians in commercial activity, including foreign SaaS and IT providers.
Why it matters
Canadian clients expect PIPEDA-compliant processing and breach reporting.
Applies in
Canada (private sector, federal; provinces such as Quebec have their own laws)
Key requirements
  • Designate a person accountable for privacy
  • Obtain meaningful consent
  • Safeguard personal information
  • Report breaches with real risk of significant harm
  • Keep breach records for 24 months

Singapore PDPA

Personal Data Protection Act 2012 (Singapore)

Law Mandatory by law Singapore

Singapore's Personal Data Protection Act governs collection, use and disclosure of personal data by organisations, enforced by the Personal Data Protection Commission. Amendments in force since 2021 added mandatory breach notification (to the PDPC within three calendar days of assessing a notifiable breach), new consent exceptions and higher fines of up to 10% of Singapore turnover for organisations with turnover above SGD 10 million, or SGD 1 million otherwise.

Covers, who needs it and key requirements
What it covers
Consent, purpose limitation, notification, access and correction, accuracy, protection, retention, transfer limitation, breach notification, data portability and the Do Not Call registry.
Who needs it
Organisations collecting or processing personal data in Singapore, including foreign IT and SaaS vendors serving Singapore clients.
Why it matters
Singapore is a regional hub and PDPC publishes enforcement decisions regularly.
Applies in
Singapore
Key requirements
  • Appoint a data protection officer
  • Consent and purpose limitation
  • Reasonable security arrangements
  • Notify notifiable breaches within 3 days
  • Transfer limitation obligations

Australian Privacy Act

Privacy Act 1988 (Cth), including the Australian Privacy Principles and the Notifiable Data Breaches scheme

Law Mandatory if in scope Australia

Australia's Privacy Act 1988 and its 13 Australian Privacy Principles govern how government agencies and organisations with annual turnover above AUD 3 million (and some smaller ones) handle personal information. The Notifiable Data Breaches scheme requires notifying the OAIC and affected individuals of eligible breaches. 2022 and 2024 amendments raised maximum penalties to the greater of AUD 50 million, three times the benefit obtained or 30% of adjusted turnover, and added a statutory privacy tort.

Covers, who needs it and key requirements
What it covers
Australian Privacy Principles, cross-border disclosure, notifiable data breaches, OAIC enforcement powers and the statutory tort for serious invasions of privacy.
Who needs it
Organisations with an Australian link that meet the turnover test or are otherwise covered, including foreign IT and SaaS providers.
Why it matters
Penalties are among the highest worldwide and Australian clients expect APP compliance from vendors.
Applies in
Australia; applies to organisations with an Australian link
Key requirements
  • Open and transparent privacy policy
  • Collection, use and disclosure according to the APPs
  • Reasonable steps to secure personal information
  • Assess and notify eligible data breaches
  • Accountability for overseas disclosures

Essential Eight

Australian Cyber Security Centre Essential Eight Maturity Model

Framework Mandatory if in scope Australia

The Essential Eight is the Australian Cyber Security Centre's prioritised set of eight mitigation strategies: application control, patching applications, configuring Microsoft Office macros, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups. Each is assessed at maturity levels one to three. Australian government entities must implement it, and it is widely requested from suppliers.

Covers, who needs it and key requirements
What it covers
Eight mitigation strategies and a maturity model from Level 1 to Level 3.
Who needs it
Australian government entities and their IT suppliers, and organisations wanting a practical baseline.
Why it matters
It is short, measurable and focused on stopping common attacks.
Applies in
Australia (mandatory for many federal agencies; voluntary elsewhere)
Key requirements
  • Application control and macro restrictions
  • Patch applications and operating systems promptly
  • User application hardening
  • Restrict admin privileges and use MFA
  • Regular, tested backups

NYDFS Part 500

New York Department of Financial Services Cybersecurity Regulation, 23 NYCRR Part 500

Regulation Mandatory if in scope New York, US

Part 500 requires banks, insurers and other financial services companies licensed by the New York DFS to run a risk-based cybersecurity programme. The second amendment (November 2023) phased in duties through November 2025, including CISO reporting to the board, MFA for all remote and privileged access, asset inventories, stricter controls for larger Class A companies, notification of cybersecurity events within 72 hours and of extortion payments within 24 hours, and annual certification by 15 April.

Covers, who needs it and key requirements
What it covers
Cybersecurity programme and policies, governance, risk assessment, access privileges, MFA, encryption, vendor management, incident response, notification and annual certification.
Who needs it
DFS-regulated financial institutions and the IT and SaaS vendors that serve them (through third-party service provider policies).
Why it matters
DFS enforces actively, and covered entities must assess and contractually bind their technology vendors.
Applies in
New York State, USA (DFS-licensed entities)
Key requirements
  • Risk-based cybersecurity programme and CISO
  • MFA for remote and privileged access
  • Third-party service provider security policy
  • Notify DFS within 72 hours of a cybersecurity event
  • Annual certification or acknowledgement of non-compliance by 15 April

GLBA Safeguards Rule

Gramm-Leach-Bliley Act and the FTC Standards for Safeguarding Customer Information (Safeguards Rule, 16 CFR Part 314)

Law Mandatory if in scope United States

The Gramm-Leach-Bliley Act requires US financial institutions to protect customers' nonpublic personal information. For non-bank financial institutions such as lenders, fintechs, tax preparers and many others, the FTC's amended Safeguards Rule requires a written information security programme with a qualified individual, risk assessment, encryption, MFA, service provider oversight and, since May 2024, notification to the FTC of security events affecting 500 or more consumers within 30 days.

Covers, who needs it and key requirements
What it covers
Privacy notices and the Safeguards Rule: written information security programme, risk assessment, access controls, encryption, MFA, monitoring, training, vendor oversight, incident response and FTC notification.
Who needs it
US financial institutions in the broad GLBA sense, including fintechs and non-bank lenders, and their IT and SaaS service providers.
Why it matters
The FTC enforces the Safeguards Rule against non-bank financial companies, and requires them to oversee their service providers.
Applies in
United States (federal)
Key requirements
  • Designate a qualified individual and write an information security programme
  • Risk assessment and safeguards including encryption and MFA
  • Oversee service providers by contract and monitoring
  • Incident response plan
  • Notify the FTC within 30 days of events affecting 500+ consumers

COPPA

Children's Online Privacy Protection Act and the FTC COPPA Rule (16 CFR Part 312)

Law Mandatory if in scope United States

COPPA requires operators of websites, apps and online services directed to children under 13, or that knowingly collect children's personal information, to give notice and obtain verifiable parental consent before collecting it. The FTC's amended COPPA Rule, published in April 2025 with compliance required by 22 April 2026, adds separate consent for third-party disclosure such as targeted advertising, a written information security programme and data retention limits.

Covers, who needs it and key requirements
What it covers
Notice, verifiable parental consent, parental rights, data minimisation, retention, security and third-party disclosures for children's personal information.
Who needs it
Apps, games, edtech and websites directed to US children, and the developers and SaaS providers building them.
Why it matters
The FTC imposes large penalties and requires deletion of unlawfully collected data and models.
Applies in
United States (federal); applies to foreign services directed to US children
Key requirements
  • Determine whether the service is child-directed or has actual knowledge
  • Post a COPPA-compliant privacy notice
  • Obtain verifiable parental consent, with separate consent for third-party disclosures
  • Written information security programme and retention policy
  • Honour parental review and deletion requests

SEC Cybersecurity Disclosure Rules

US SEC Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure rules (2023)

Regulation Mandatory if in scope US-listed companies

Since December 2023, US-listed companies must disclose material cybersecurity incidents on Form 8-K Item 1.05 within four business days of determining materiality, and describe their cybersecurity risk management, strategy and governance annually under Regulation S-K Item 106. Foreign private issuers make equivalent disclosures on Forms 6-K and 20-F. IT vendors are affected because incidents at third parties can trigger client disclosures.

Covers, who needs it and key requirements
What it covers
Material incident disclosure, annual description of risk management processes, board oversight and management's role in cybersecurity.
Who needs it
SEC registrants and companies preparing to list, and their critical IT and SaaS vendors.
Why it matters
Listed clients need fast, accurate incident information from vendors to meet the four-day clock.
Applies in
United States (SEC registrants, including foreign private issuers via Forms 6-K and 20-F)
Key requirements
  • Process to assess materiality of incidents without unreasonable delay
  • File Form 8-K Item 1.05 within four business days of a materiality determination
  • Annual Item 106 disclosure of risk management, strategy and governance
  • Third-party risk processes that surface vendor incidents quickly

TISAX

Trusted Information Security Assessment Exchange (automotive industry), based on the VDA Information Security Assessment (ISA)

Certifiable standard Contractually required Global (automotive)

TISAX is the automotive industry's assessment and exchange mechanism for information security, run by the ENX Association on behalf of the German automotive association VDA. Suppliers are assessed by accredited audit providers against the VDA ISA catalogue, which is based on ISO 27001 with automotive extensions for prototype protection and data protection, and receive labels they share with OEMs through the ENX portal. Car makers commonly require it from IT and engineering suppliers.

Covers, who needs it and key requirements
What it covers
Information security, prototype protection and data protection controls from the VDA ISA catalogue at assessment levels 1 to 3.
Who needs it
IT, software and engineering suppliers to automotive OEMs and Tier 1 suppliers.
Why it matters
Automotive customers often make a TISAX label a contract condition.
Applies in
Worldwide, mainly suppliers to European (especially German) automotive companies
Key requirements
  • Register with ENX and select assessment objectives
  • Self-assess against the VDA ISA catalogue
  • Assessment by an accredited TISAX audit provider
  • Share labels with partners via the ENX portal and renew every three years
Quick answers

Which compliance does my business need?

A starting point by business type. Your actual scope depends on your customers, data and contracts, so confirm it with the full guide.

B2B SaaS selling to US or global enterprises

Enterprise security questionnaires usually ask for a SOC 2 Type II report or an ISO 27001 certificate. Many vendors end up with both, built on one control set.

SOC 2ISO 27001

Any business with users or clients in the EU

GDPR applies when you offer services to people in the EU or monitor their behaviour, wherever you are based. If your product uses AI, check which EU AI Act risk tier applies.

GDPREU AI Act

IT companies operating in India

The IT Act and CERT-In Directions apply today (6-hour incident reporting, 180-day logs). The DPDP Act's main duties start on 13 May 2027.

DPDP ActIT Act 2000CERT-In Directions

Products that take card payments

Your scope depends on how you integrate payments. Hosted payment pages and tokenisation can shrink it to a short self-assessment questionnaire.

PCI DSS

Software that handles US patient data

If you create, receive, store or transmit protected health information for a covered entity, you are a business associate and must sign a BAA.

HIPAA

Cloud services for US federal agencies

FedRAMP authorization is required before agencies can use a cloud service. It is built on NIST SP 800-53 controls.

FedRAMPNIST SP 800-53FISMA

Companies building or deploying AI

The EU AI Act is law in the EU; ISO 42001 is a voluntary, certifiable AI management system that helps show responsible AI governance.

EU AI ActISO 42001

Software development companies and agencies

Clients increasingly ask for secure development evidence (OWASP-based testing) and an ISO 27001 or ISO 9001 certificate in RFPs.

OWASP Top 10ISO 27001ISO 9001

Get help

Get an IT compliance assessment

Tell us which standard or law you are working towards. We will put you in touch with vetted compliance and cybersecurity firms from our directory, or answer your question directly.

  • Gap assessments for ISO 27001, SOC 2, PCI DSS, HIPAA and GDPR
  • DPDP Act and CERT-In readiness for Indian companies
  • Penetration testing and secure development reviews
  • No obligation; we never share your details without asking
Browse cybersecurity companies Get quotes

Request an assessment

Free and confidential. We reply within one business day.

How we research and review these guides

  • Every requirement is taken from the official text: the law, the regulator's rules or the standard body's own publications. Each guide lists its sources.
  • We say clearly whether something is a law, a voluntary standard, a framework or an audited certification, and which version and dates apply.
  • Guides carry a published date, a last-reviewed date and a next-review date. Fast-moving topics (AI, privacy, Indian rules) are reviewed at least every six months, and immediately when an official change is announced.
  • We do not copy other sites, accept payment to change a guide, or rank the companies in our directory by who advertises.
Not legal advice

These guides explain official sources in plain language for IT companies. Laws change and how they apply depends on your facts, so for decisions with legal consequences speak to a qualified lawyer, auditor or certification body. Spotted an error or a change? Tell us and we will review it.

FAQ

IT compliance questions

What is IT compliance?
IT compliance means meeting the legal, regulatory, contractual and voluntary requirements that apply to how an organisation uses technology and handles data. It covers security controls, privacy, incident reporting, record keeping and the evidence that you do what you say.
Is ISO 27001 mandatory?
No. ISO/IEC 27001 is a voluntary standard. It becomes effectively required when a client, tender or regulator asks for it, which is common in enterprise IT and government contracts.
What is the difference between a law, a standard and a framework?
A law or regulation is binding if you are in scope and can be enforced with fines. A standard is a published specification you choose to follow; some can be independently certified. A framework is voluntary guidance or a control catalogue that helps you organise your programme, usually without a certificate of its own.
Which compliance should a small software company start with?
Start with the laws that already apply to you (for example the IT Act and CERT-In Directions in India, GDPR if you have EU users) and a basic control baseline such as CIS Controls Implementation Group 1. Add SOC 2 or ISO 27001 when customers start asking for them.
Can one programme cover several standards?
Yes. Most frameworks share core controls such as access management, logging, encryption, vendor management and incident response. A single control set mapped to ISO 27001, SOC 2 and the laws that apply to you avoids doing the same work several times.
Is this website legal advice?
No. These guides explain official sources in plain language and are reviewed regularly, but laws change and their application depends on your facts. For decisions with legal consequences, ask a qualified lawyer or auditor.

List your IT company for free

Create a profile in minutes, get reviewed by our editors and start receiving enquiries from clients looking for your skills.

Get listed free