Compliance Frameworks.

Service Organization Control 2 (Point-in-time)

Evaluates the design of security controls at a specific point in time.

Service Organization Control 2 (Period-of-time)

The industry standard for SaaS security, evaluating control effectiveness over 6-12 months.

Information Security Management System

The primary international standard for establishing and maintaining an ISMS.

Cloud Security Controls

Guidelines for information security controls applicable to the provision and use of cloud services.

Cloud Privacy Protection

Focuses on protecting personal data in the cloud.

Business Continuity Management

Specifies requirements to plan, establish, and operate a documented management system to protect against disruptions.

NIST Cybersecurity Framework

A voluntary framework to manage and reduce cybersecurity risk for critical infrastructure.

Security and Privacy Controls for Information Systems

A comprehensive catalog of controls for federal information systems.

Protecting CUI in Nonfederal Systems

Required for contractors handling Controlled Unclassified Information.

General Data Protection Regulation

The primary regulation in EU law on data protection and privacy.

California Consumer Privacy Act

Empowers California consumers with rights over their personal data.

California Privacy Rights Act

An amendment to CCPA that adds new consumer privacy rights.

Virginia Consumer Data Protection Act

Virginia's comprehensive data privacy law.

Lei Geral de Proteção de Dados

Brazil's comprehensive data protection law.

Personal Data Protection Act (Singapore)

Governs the collection, use, and disclosure of personal data by organizations in Singapore.

Personal Information Protection and Electronic Documents Act

Canada's federal privacy law for private-sector organizations.

Protection of Personal Information Act

South Africa's data protection law.

Health Insurance Portability and Accountability Act

US law providing data privacy and security provisions for safeguarding medical information.

Health Information Trust Alliance

A certifiable framework that leverages various standards for healthcare security.

Health Information Technology for Economic and Clinical Health

Promotes the adoption and meaningful use of health information technology.

Payment Card Industry Data Security Standard

The latest global standard for securing credit card data.

Gramm-Leach-Bliley Act

Requires financial institutions to explain their information-sharing practices to customers.

Federal Financial Institutions Examination Council

Uniform principles and standards for the federal examination of financial institutions.

Service Organization Control 1

Focuses on controls at a service organization relevant to user entities' internal control over financial reporting.

Federal Risk and Authorization Management Program

Security standards for cloud services used by the US federal government (High Impact).

Federal Risk and Authorization Management Program

Security standards for cloud services used by the US federal government (Moderate Impact).

Cybersecurity Maturity Model Certification

Foundational cybersecurity for DOD contractors.

Cybersecurity Maturity Model Certification

Advanced cybersecurity protecting CUI.

Federal Information Security Modernization Act

Requires federal agencies to develop, document, and implement an information security program.

Information Technology Risk Rating

System for evaluating IT risk within government agencies.

Cloud Security Alliance STAR Self-Assessment

A rigorous self-assessment for cloud provider transparency.

Cloud Security Alliance STAR Attestation

Third-party independent assessment of cloud security.

Texas Risk and Authorization Management Program

Security requirements for cloud providers doing business with Texas state agencies.

State Risk and Authorization Management Program

Cybersecurity standards for cloud service providers serving state and local governments.

ACSC Essential Eight

Australia's baseline cybersecurity strategies.

UK Cyber Essentials

A UK government-backed, industry-supported scheme to help organizations protect against cyber threats.

Trusted Information Security Assessment Exchange

Information security standard for the European automotive industry.

Family Educational Rights and Privacy Act

Protects the privacy of student education records.

Children's Online Privacy Protection Act

Regulates the collection of personal information from children under 13.

Custom Governance, Risk & Compliance

Build your own internal framework based on specific organizational needs.

Quality Management Systems

The international standard for quality management.

Environmental Management

Standard for environmental management systems.

IT Service Management

International standard for IT service management.

Occupational Health and Safety

International standard for health and safety at work.

Information Security Registered Assessors Program

Australian government security assessment.

National Electronic Security Authority

UAE federal authority responsible for cybersecurity.

Saudi Arabian Cybersecurity Standard

Cybersecurity requirements for entities in Saudi Arabia.

UK Cyber Essentials Plus

Verified version of the Cyber Essentials scheme.

Information Security Standard

Australian Prudential Regulation Authority standard for information security.

Cybersecurity Requirements for Financial Services Companies

New York state regulation for financial institutions.

Monetary Authority of Singapore Technology Risk Management

Guidelines for managing technology risk in financial institutions in Singapore.

Korea Information Security Management System

Information security certification system in South Korea.

Thailand Risk and Authorization Management Program

Cloud security standards for the Thai government.