CMMC
2.0 (Final Rule December 2024)
Cybersecurity Maturity Model Certification 2.0
CMMC 2.0 ensures that Defense Industrial Base (DIB) companies implement cybersecurity practices to protect Controlled Un...
United States
defensegovernmentcui
4Domains
16Controls
Triennial assessment with annual affirmationCycle
DORA
2022 (effective January 17, 2025)
Digital Operational Resilience Act (EU Regulation 2022/2554)
DORA harmonizes ICT risk management rules across the EU financial sector, ensuring all participants can withstand, respo...
European Union
financial-servicesoperational-resilienceeu
5Domains
20Controls
Ongoing compliance; supervisory reviewsCycle
GDPR
2016 (effective May 25, 2018)
General Data Protection Regulation (EU) 2016/679
The GDPR enforces rigorous data privacy laws across the EU, applying extraterritorially to any global organization proce...
European Union (Extraterritorial)
privacydata-protectioneu
5Domains
20Controls
Ongoing compliance; DPA investigations are complaint-drivenCycle
HIPAA
2013 Omnibus Rule (Updated)
Health Insurance Portability and Accountability Act - Security Rule
HIPAA establishes the definitive federal standard for protecting sensitive patient data. The Security Rule establishes n...
United States
healthcareephifederal
2Domains
16Controls
Ongoing (OCR audits are random/complaint-driven)Cycle
ISO 27001
2022
ISO/IEC 27001:2022 - Information Security Management Systems
ISO/IEC 27001 is the international gold standard for establishing, implementing, maintaining, and continually improving ...
Global
certificationismsglobal
4Domains
32Controls
Annual surveillance, triennial recertificationCycle
ISO 42001
2023
ISO/IEC 42001:2023 - Information Technology - Artificial Intelligence Management System
ISO 42001 is the world's first international certifiable management system standard for Artificial Intelligence. It prov...
Global
artificial-intelligencemanagement-systemcertifiable
4Domains
22Controls
3-year certification cycle with annual surveillance auditsCycle
NIS 2
2022 (transposition deadline October 17, 2024)
Network and Information Security Directive 2 (EU Directive 2022/2555)
NIS 2 dramatically expands the scope of EU cybersecurity regulation from the original NIS Directive. It covers 18 critic...
European Union
cybersecuritycritical-infrastructureeu
3Domains
15Controls
Ongoing compliance; supervisory reviews and auditsCycle
NIST 800-171 Rev 3
Revision 3 (May 2024)
NIST Special Publication 800-171 Revision 3 — Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
NIST SP 800-171 Rev 3 specifies security requirements for protecting the confidentiality of Controlled Unclassified Info...
United States
cuidefensegovernment
17Domains
115Controls
Triennial assessment with annual affirmation (aligned with CMMC)Cycle
NIST 800-53
Revision 5 (September 2020, updated December 2024)
NIST Special Publication 800-53 Revision 5 — Security and Privacy Controls for Information Systems and Organizations
NIST SP 800-53 Rev 5 provides a comprehensive catalog of security and privacy controls for federal information systems a...
United States
federalgovernmentfisma
20Domains
322Controls
Continuous monitoring with annual assessmentCycle
NIST AI RMF
1.0 (January 2023)
NIST Artificial Intelligence Risk Management Framework 1.0
The NIST AI RMF provides a voluntary framework for managing risks associated with AI systems throughout their lifecycle....
United States (Voluntary - Global Influence)
artificial-intelligencerisk-managementtrustworthy-ai
4Domains
19Controls
Continuous per AI system lifecycleCycle
PCI DSS
4.0.1
Payment Card Industry Data Security Standard
PCI DSS provides a rigorous technical and operational baseline for protecting Cardholder Data (CHD) and Sensitive Authen...
Global
payment-cardsfinancialglobal
6Domains
12Controls
Annual assessment; quarterly vulnerability scansCycle
SOC 2
2017 (TSC 2017)
System and Organization Controls 2
SOC 2 is the prevailing compliance standard for technology service providers, SaaS platforms, and cloud-native organizat...
North America (Global adoption)
attestationtrust-servicessaas
5Domains
42Controls
AnnualCycle