Cybersecurity Frameworks & Standards
Browse ISO 27001, SOC 2, NIST CSF, CIS Controls and more — every control mapped to its equivalents across other frameworks and regulations.
ISO 27001
ISO/IEC 27001:2022
Any organization, of any size or sector, that wants to certify its information security management system. Certification is voluntary but is frequently required contractually by enterprise customers and partners.
9 Annex A Controls · International · 2022
SOC 2
SOC 2 (AICPA Trust Services Criteria)
Service organizations — especially SaaS and cloud providers — that store or process customer data and are asked to demonstrate security through an independent auditor's report. Driven by customer and procurement requirements rather than law.
6 Trust Services Criteria · US · 2017
NIST CSF 2.0
NIST Cybersecurity Framework 2.0
Any organization seeking a common language to assess and manage cybersecurity risk. Voluntary, but widely adopted by US critical-infrastructure operators and referenced by regulators and contracts worldwide.
8 Subcategories · US · 2024
CIS Controls v8
CIS Critical Security Controls v8
Any organization wanting a prioritised, practical security baseline. Scales by implementation group (IG1–IG3), so small businesses and large enterprises can adopt a right-sized subset.
8 Safeguards · International · 2021
NIST 800-53
NIST SP 800-53 Rev. 5
Mandatory for US federal information systems under FISMA and for many federal contractors; widely reused worldwide as the reference control catalog that underpins FedRAMP, CMMC and other programs.
10 Controls · US · 2020
NIST 800-171
NIST SP 800-171 Rev. 2
Contractors and subcontractors that store, process or transmit Controlled Unclassified Information (CUI) for the US government, enforced for the defense sector through DFARS clauses and CMMC.
7 Requirements · US · 2020
Essential Eight
ACSC Essential Eight
Recommended for all Australian organizations and mandatory for non-corporate Commonwealth entities. A pragmatic baseline measured across maturity levels ML1 to ML3.
8 Mitigation Strategies · AU · 2017
Cyber Essentials
UK Cyber Essentials
Any UK organization wanting a certified baseline against common internet threats. Required to bid for certain UK government contracts, especially those handling personal or sensitive information.
5 Technical Controls · UK · 2014
PCI DSS
PCI DSS v4.0
Any organization worldwide that stores, processes or transmits payment card data, and any entity that can affect the security of cardholder data. Enforced by the card brands through acquiring banks, not by law.
8 Requirements · International · 2022