Standards & framework document library

A voluntary, outcome-based framework for managing and reducing cybersecurity risk.

A comprehensive catalog of security and privacy controls for information systems.

A governance and management framework for enterprise information and technology.

A prioritised set of 18 safeguards that stop the most common attacks.

A knowledge base of real-world adversary tactics and techniques.

The most dangerous and common software weaknesses developers must avoid.

The standard awareness document for the most critical web application risks.

A business-driven framework and methodology for enterprise security architecture.

The Cloud Controls Matrix and STAR programme for cloud security assurance.

The leading enterprise architecture framework and method (ADM).

Protecting Controlled Unclassified Information (CUI) in non-federal systems.

The standard for cybersecurity of industrial automation and control systems.

A security model of "never trust, always verify" for modern architectures.

A knowledge base of defensive countermeasures mapped to ATT&CK.

A detailed, testable standard for verifying application security.

The leading framework for internal control and enterprise risk management.

A knowledge base of adversarial threats to AI and machine-learning systems.

The most critical security risks to APIs.

Guidance for managing information security risk.

The standard for information security incident management.

ICT readiness for business continuity.

Standards for vulnerability disclosure and handling.

Secure software development practices (SP 800-218).

Digital identity guidelines — identity proofing, authentication and federation.

Voluntary framework to manage risks of AI systems.

CSA control matrix for securing and governing AI systems.

Harmonised cybersecurity profile for the financial sector.

Metaframework mapping controls across 100+ authorities.

Cyber supply-chain risk management practices for systems.

Guide to securing operational technology and control systems.

CSF profile to prevent, detect and recover from ransomware.

Maturity model to evaluate and improve cyber capabilities.

Security standard for systems that use cryptocurrencies.

Capability Maturity Model Integration — a model for building repeatable, measurable, continually improving organisational capability.

The international standard for an Information Security Management System (ISMS).

An attestation report on controls relevant to security, availability and privacy.

The security standard for organisations that handle payment card data.

SWIFT’s Customer Security Controls Framework for institutions on the SWIFT network.

Standards for secure PIN management and point-to-point encryption of card data.

A certifiable security framework that harmonises HIPAA, ISO, NIST, PCI and more.

Cybersecurity Maturity Model Certification for the US defense supply chain.

The US government authorisation programme for cloud services.

The international standard for business continuity management systems (BCMS).

Cloud-specific information security controls extending ISO 27002.

The management-system standard for artificial intelligence (AIMS).

The international standard for an IT service management system (SMS).

The international standard for a quality management system (QMS).

IT general controls supporting Sarbanes-Oxley financial-reporting compliance.

The information-security assessment standard for the automotive industry.

International product security evaluation and certification.

Validation of cryptographic modules to US federal standards.

PCI standards for payment software security and 3-D Secure.

Cybersecurity engineering for road vehicles.

Cybersecurity for medical devices across the product lifecycle.

German catalogue of cloud security controls attested by auditors.

Management system for security of the supply chain.

Health-sector application of ISO 27002 controls.

The EU regulation governing the processing of personal data.

US law protecting the privacy and security of protected health information (PHI).

A privacy extension (PIMS) to ISO 27001 for managing personal data.

California’s consumer privacy law and its CPRA amendments.

Protection of personal data (PII) in public cloud services.

Brazil’s General Data Protection Law for personal data.

South Africa’s Protection of Personal Information Act.

Singapore’s Personal Data Protection Act.

Canada’s federal private-sector privacy law.

Transatlantic mechanism for lawful personal-data transfers.

India’s data-protection law governing the personal data of data principals.

Baseline cyber security and resilience controls mandated by RBI for banks.

RBI’s master direction on securing internet, mobile and card digital payment channels.

RBI’s master direction on IT governance, risk, controls and IS assurance practices.

Authorisation and security requirements for payment aggregators and payment gateways.

Rules for issuing and operating prepaid payment instruments (wallets, cards).

Annual system audit and payment-data localisation assurance for payment system operators.

Security audit requirements for UPI Third-Party Application Providers and PSP banks.

System audit requirements for BBPS operating units in the bill-payment ecosystem.

SEBI’s Cyber Security and Cyber Resilience Framework for regulated entities.

Information and cyber security guidelines for insurers and intermediaries.

Security and audit requirements for entities in the Aadhaar authentication ecosystem.

CERT-In’s directions on incident reporting, log retention and security practices.

The consent-based financial-data-sharing framework in India.

RBI’s IT governance, security and audit expectations for NBFCs.

Information and cyber security audit for the pension (NPS) ecosystem.

Cyber security and resilience audit for regulated entities in GIFT IFSC.

Information systems and cyber security audit for housing finance companies.

Technical and privacy due-diligence audit of digital lending apps and service providers.

Basic and Comprehensive (graded) cyber security framework audit for UCBs.

Audit of IT outsourcing, cloud and supply-chain risk for RBI-regulated entities.

Audit of fraud governance, monitoring and reporting technology for REs.

Audit of KYC and Video-based Customer Identification Process technology controls.

Security audits across NPCI’s payment products beyond UPI.

System audits for stock brokers, clearing members and market infrastructure institutions.

Cyber security audit under CERT-In’s 2025 audit policy guidelines.

Government testing and certification for IT products, e-governance and security.

Mandatory Testing and Certification of Telecom Equipment, including security.

Protection and audit of Critical Information Infrastructure in India.

Audit of Certifying Authorities, eSign and digital-signature ecosystems.

Government website guidelines and web accessibility compliance audit.

Security and privacy audit for the Ayushman Bharat Digital Mission ecosystem.

Cyber security in the power/electricity sector under CEA regulations.

Mandatory cyber security framework for financial institutions in Saudi Arabia.

Saudi Arabia’s mandatory Essential Cybersecurity Controls for national entities.

The UAE’s Information Assurance standards for government and critical entities.

Qatar’s National Information Assurance standard for information security.

Technology Risk Management guidelines for Singapore financial institutions.

Information security prudential standard for APRA-regulated entities.

Eight prioritised mitigation strategies against cyber threats.

A UK government-backed certification for baseline cyber hygiene.

EU regulation on ICT and operational resilience for financial entities.

EU directive raising cybersecurity for essential and important entities.

Risk-tiered EU regulation governing AI systems and models.

UK regulatory rules on operational resilience for financial firms.

US financial-privacy and information-safeguards requirements.

New York cybersecurity rules for financial-services companies.

US banking regulators' cyber maturity and IT examination framework.

Mandatory cyber standards for the North American bulk power system.

Security policy protecting US criminal-justice information.

Canadian guideline on technology and cyber risk for FRFIs.

Korean certification for information security and privacy management.

Japanese assessment program for government cloud services.

China's data-protection, cybersecurity and grading regime.

Australian government security manual and assessor program.