Frameworks and laws
Everything that is already inside
Each framework and law comes as a plain-language checklist you can work through, tick off and share. Not sure which ones apply to you? The GRC Advisor in the portal works it out from five short questions.
19 security and AI frameworks GRC
CIS Controls v8.1
The CIS Critical Security Controls are a set of 18 prioritized best practices developed by the Center for Internet Security to help organizations protect against common cyber threats.
CMMC Level 2
The Cybersecurity Maturity Model Certification (CMMC) Level 2 is the US Department of Defense framework that requires contractors handling Controlled Unclassified Information (CUI) to implement the 110 security practices of NIST SP 800-171 and prove it through assessment.
Criminal Justice Information Services (CJIS) v6.0
The Criminal Justice Information Services (CJIS) Security Policy is an FBI framework that defines the minimum security requirements for protecting Criminal Justice Information (CJI).
Cyber Assessment Framework (CAF)
The Cyber Assessment Framework, developed by the UK’s National Cyber Security Centre (NCSC), provides a structured approach to assessing and improving the resilience of organizations that operate essential services and critical national infrastructure.
DPDP Act 2023 (India)
The Digital Personal Data Protection Act, 2023 is India's law on how organisations collect, use, store and share digital personal data.
Essential Eight
The Essential Eight is a set of eight prioritised mitigation strategies published by the Australian Cyber Security Centre (ACSC) to help organisations defend against common cyber threats, assessed across maturity levels.
GDPR
GDPR (General Data Protection Regulation) is the European Union’s data protection regulation for safeguarding personal data and privacy.
GTIA Cybersecurity Trustmark
GTIA Cybersecurity Trustmark is a cybersecurity certification designed specifically for Managed Service Providers (MSPs).
HICP (Health Industry Cybersecurity Practices)
The Health Industry Cybersecurity Practices were developed by the U.S. Department of Health and Human Services (HHS) to help healthcare organizations reduce cyber risks that threaten patient safety and data security.
HIPAA
HIPAA is a U.S. federal law that establishes national standards to protect the privacy and security of protected health information (PHI).
ISO/IEC 27001:2022
ISO/IEC 27001 is an international standard for building and maintaining an Information Security Management System (ISMS).
ISO/IEC 42001:2023 (AI management system)
ISO/IEC 42001:2023 is the international standard for an AI management system (AIMS).
NIST AI RMF 1.0 (AI Risk Management Framework)
The NIST AI Risk Management Framework (AI RMF 1.0, January 2023) is a voluntary framework from the US National Institute of Standards and Technology for managing risks from AI systems.
NIST CSF 2.0
The NIST Cybersecurity Framework v2.0 expands on the widely used CSF to help organizations manage cybersecurity risk across all sectors and sizes, not just critical infrastructure.
NIST CSF v1.1
The NIST Cybersecurity Framework v1.1 provides voluntary guidance to help organizations of all sizes manage and reduce cybersecurity risk.
NIST SP 800-171 Rev 3.0
NIST Special Publication 800-171 Rev. 3 establishes security requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems and organizations.
PCI DSS v4.0.1
PCI DSS v4.0 is a global security standard for organizations that store, process, or transmit payment card data.
SOC 2
SOC 2 (System and Organization Controls 2) is a compliance framework that assesses an organization’s information security practices.
SPECTRA Certification Standards
The SPECTRA Certification Standards establish a minimum viable baseline for evaluating Managed Service Providers (MSPs) on their ability to secure both their own operations and the customer environments they manage.
93 laws and regulations across 53 jurisdictions GRC
GDPR, U.S. federal and industry rules such as GLBA, and the data protection and breach notification laws of U.S. states, each summarised in four short answers: why it exists, key terms, deadlines and technical requirements. The number shows how many laws are included for each place.
6 vulnerability lists VAPT
VAPT findings are mapped to these reference lists. Each item explains why it matters and comes with a prompt that helps your AI coding tool avoid it.
Need a framework that is not listed? Tell us and we will let you know if it is on the way.