Skip to content

Esta página también está disponible en español.

Ver en español
Almenara

Framework catalogue

What you have already proven carries over to the next framework

Every framework is mapped to Almenara’s common controls: evidence you already have counts for every framework that asks for it, and in Compliance you see what is missing for the next one.

Behind it is our own study of the standards and the markets, framework by framework. Every one on this list is available in Compliance: you can answer it and attach your evidence.

Request informationSee how it works in Compliance

Frameworks by region

198 frameworks

Spain

  • National Security Framework - ENS (Royal Decree 311/2022)ENS

    Ministerio para la Transformación Digital y de la Función Pública - Gobierno de España · Spain · Law or regulation

    Version 2022 · Languages es en

    Mandatory for the Spanish public sector and for the companies that provide services to it.

    Available in ComplianceIn-depth guide: National Security Framework - ENS (Royal Decree 311/2022)

EU

  • CER directive (Critical Entities Resilience)CER-directive

    EU · EU · Law or regulation

    Languages en fr

    Available in Compliance

  • Cloud Sovereignty Frameworkcloud-sovereignty-framework

    EUROPEAN COMMISSION · EU · Framework or guidance

    Languages en

    Available in Compliance

  • Cyber Resilience Act - Annexes (CRA)CRA-resolution-annexes

    EU · EU · Law or regulation

    Languages en

    Available in Compliance

  • Cyber resilience oversight expectations for financial market infrastructuresCROE-for-FMI

    EUROPEAN CENTRAL BANK · EU · Framework or guidance

    Languages en

    Available in Compliance

  • Digital Operational Resilience Act (DORA)DORA

    EU · EU · Law or regulation

    Languages en es cs fr

    Applies since 17 January 2025 to EU financial entities and reaches their ICT providers.

    Available in ComplianceIn-depth guide: Digital Operational Resilience Act (DORA)

  • ENISA 5G Security Control Matrix v1.3ENISA 5G SCM v1.3

    ENISA · EU · Control catalogue

    Version 1.3 · Languages en

    Available in Compliance

  • ENISA SME Cyber Resilience Maturity Assessment (CRA)ENISA-CRA-Maturity

    ENISA · EU · Framework or guidance

    Languages en de

    Available in Compliance

  • EU Artificial Intelligence Act (AI Act)AI Act

    EU · EU · Law or regulation

    Languages en

    Available in Compliance

  • EUDI_ARF_ANNEX 2.02 - High-Level Requirements by topicEUDI_ARF_ANNEX 2.02 - High-Level Requirements by topic

    EU · EU · Control catalogue

    Version 2.02 · Languages en

    Available in Compliance

  • European sustainability reporting standards (ESRS 1/ESRS 2)ESRS 1/ESRS 2

    EUROPEAN COMMISSION · EU · Law or regulation

    Languages en

    Available in Compliance

  • European sustainability reporting standards (ESRS E1/ESRS E2/ESRS E3/ESRS E4/ESRS E5)ESRS E1/ESRS E2/ESRS E3/ESRS E4/ESRS E5

    EUROPEAN COMMISSION · EU · Law or regulation

    Languages en

    Available in Compliance

  • European sustainability reporting standards (ESRS S1/ESRS S2/ESRS S3/ESRS S4/ESRS G1)ESRS S1/ESRS S2/ESRS S3/ESRS S4/ESRS G1

    EUROPEAN COMMISSION · EU · Law or regulation

    Languages en

    Available in Compliance

  • GDPR checklist for data controllersGDPR-checklist

    GDPR.EU · EU · Framework or guidance

    Languages en pl fr

    Available in Compliance

  • General Data Protection RegulationGDPR

    EU · EU · Law or regulation

    Languages en sv

    Available in Compliance

  • GL-on-costs-and-lossesGL-on-costs-and-losses

    ESMA · EU · Framework or guidance

    Languages en

    Available in Compliance

  • ITS DORA incident reportingITS-DORA-incident-reporting

    ESA · EU · Law or regulation

    Languages en

    Available in Compliance

  • NIS 2 directive requirementsNIS2-directive

    EU · EU · Law or regulation

    Languages en fr de es

    Directive in force; in Spain, the law that transposes it is still going through the legislative process.

    Available in ComplianceIn-depth guide: NIS 2 directive requirements

  • NIS2 - Annex to the Commission Implementing Regulation 2024/2690 with Technical Implementation Guidance by ENISAannex-nis2-regulation--2024-2690-with-technical-implementation-guidance-by-enisa

    EUROPEAN COMMISSION + ENISA · EU · Law or regulation

    Version 2024 · Languages en de fr es cs it

    Available in Compliance

  • PART-IS.D.OR (Delegated Regulation (EU) 2022/1645 - Consolidated 16-10-2025)EASA-PART-IS.D.OR

    EU COMMISSION · EU · Law or regulation

    Version 2025 · Languages en fr

    Available in Compliance

  • RTS DORA - Incident reportingRTS-DORA-incident-reporting_official

    EUROPEAN COMMISSION · EU · Law or regulation

    Languages en fr

    Available in Compliance

  • RTS DORA on harmonisation of conditions enabling the conduct of the oversight activitiesRTS-DORA-OVS-conduct

    ESA · EU · Law or regulation

    Languages en

    Available in Compliance

  • RTS DORA on JETRTS-DORA-on-JET

    ESA · EU · Law or regulation

    Languages en

    Available in Compliance

  • RTS DORA threat led penetration testsRTS-DORA-TLPT

    ESA · EU · Law or regulation

    Languages en

    Available in Compliance

  • RTS on ICT risk management framework and on simplified ICT risk management frameworkRTS-DORA-ICT-risk-management

    EUROPEAN COMMISSION · EU · Law or regulation

    Languages en fr

    Available in Compliance

  • RTS to specify the policy on ICT services supporting critical or important functions provided by ICT third-party service providers (TPPs)RTS-DORA-ICTservices-supporting

    EUROPEAN COMMISSION · EU · Law or regulation

    Languages en

    Available in Compliance

  • TIBER-EU FRAMEWORKTIBER-EU-2018

    ECB · EU · Framework or guidance

    Version 2018 · Languages en

    Available in Compliance

France

  • ANSSI - Active Directory (AD) Security Assessment Checklist [April 2026]anssi-points-de-controle-active-directory

    ANSSI · France · Technical configuration (benchmarks)

    Version 2026 · Languages fr en

    Available in Compliance

  • ANSSI - Certification PASSIPASSI Framework 2.2

    ANSSI · France · Certifiable standard

    Version 2.2 · Languages fr

    Available in Compliance

  • ANSSI - Cybersécurité des systèmes industriels - Mesures détailléesANSSI-PA-108

    ANSSI · France · Control catalogue

    Languages fr

    Available in Compliance

  • ANSSI - Guide d'hygiène informatique - version détailléeANSSI-GUIDE-HYGIENE-DETAIL

    ANSSI · France · Framework or guidance

    Languages fr

    Available in Compliance

  • ANSSI - Questionnaire MonAideCyberANSSI-MonAideCyber

    ANSSI · France · Framework or guidance

    Languages fr

    Available in Compliance

  • ANSSI - Recommandations pour les architectures des Systèmes d'Information (SI) sensibles ou Diffusion Restreinte (DR) - v1.2ANSSI-rec-architectures-Systeme-Information-sensibles-ou-Diffusion-Restreinte

    ANSSI · France · Framework or guidance

    Version 1.2 · Also anssi-architectures-si-sensibles-dr · Languages fr

    Available in Compliance

  • ANSSI - Sécurisation des systèmes de contrôle d’accès physique et vidéoprotection (v2.2) [Recommandations]ANSSI_rec-secu-sys-ctrl-acces-phys-videoprot_v2.2

    ANSSI · France · Technical configuration (benchmarks)

    Version 2.2 · Also 2.1 · Languages fr

    Available in Compliance

  • ANSSI: autoévaluation de gestion de crise cyberANSSI-MATURITE-GESTION-CRISE

    ANSSI · France · Framework or guidance

    Languages fr

    Available in Compliance

  • ANSSI: RECOMMANDATIONS DE SÉCURITÉ POUR UN SYSTÈME D'IA GÉNÉRATIVEanssi-genai-security-recommendations-1.0

    ANSSI · France · Framework or guidance

    Version 1.0 · Languages fr

    Available in Compliance

  • Cadre de Conformité Cyber France (3CF) pour l'aviation civile - v3.13CF-v3.1

    DSAC / OSAC · France · Framework or guidance

    Version 3.1 · Also v1, v2 · Languages fr

    Available in Compliance

  • Cahier des Charges Label EBIOS RM v3.1Cahier-des-Charges-Label-EBIOS-RM-v3.1

    ANSSI · France · Certifiable standard

    Version 3.1 · Languages fr

    Available in Compliance

  • Checklist de dossier d'homologationChecklist de dossier d'homologation

    France · Framework or guidance

    Languages fr

    Available in Compliance

  • Clausier Sécurité Santé v2024Clausier-sante-v2.0.1

    Club RSSI Santé · France · Framework or guidance

    Version 2.0.1 · Languages fr

    Available in Compliance

  • CNIL : guide de sécurité des donnéescnil-guide-securite

    CNIL · France · Framework or guidance

    Languages fr

    Available in Compliance

  • Formulaire d'évaluation de la maturité - niveau fondamental (DGA)formulaire-d-évaluation-de-la-maturité-niveau-fondamental-dga/ssdi

    DGA/SSDI · France · Framework or guidance

    Languages fr

    Available in Compliance

  • Guideline for a healthy information systemANSSI-GUIDE-HYGIENE

    ANSSI · France · Framework or guidance

    Languages fr en

    Available in Compliance

  • Guides des mécanismes cryptographiquesANSSI-GUI-MECA-CRYPT

    ANSSI · France · Technical configuration (benchmarks)

    Languages fr

    Available in Compliance

  • HDS v2.0HDS-v2.0

    Agence du Numérique en Santé · France · Certifiable standard

    Version 2.0 · Languages fr

    Available in Compliance

  • IGI 1300 — General interministerial instruction on the protection of national defence secretsIGI-1300

    ANSSI · France · Law or regulation

    Languages fr

    Available in Compliance

  • II n° 901/SGDSN/ANSSI - Instruction interministérielle n° 901 relative à la protection des systèmes d'information sensiblesII-901

    ANSSI · France · Law or regulation

    Languages fr

    Available in Compliance

  • NIS-1 rulesNIS-1 FR

    Gouvernement français · France · Law or regulation

    Languages fr en

    Available in Compliance

  • PGSSI-S v1.0pgssi-s-1.0

    ANS · France · Framework or guidance

    Version 1.0 · Languages fr

    Available in Compliance

  • Prestataires de Détection des Incidents de Sécurité (PDIS)PDIS

    ANSSI · France · Certifiable standard

    Languages fr

    Available in Compliance

  • Prestataires de services d’informatique en nuage (SecNumCloud) - référentiel d’exigencesSecNumCloud v3.2

    ANSSI · France · Certifiable standard

    Version 3.2 · Languages fr

    Available in Compliance

  • Programme CaRE - Domaine 2 : Continuité et reprise d'activité, sauvegarde et restaurationCaRE-D2

    Agence du Numérique en Santé · France · Framework or guidance

    Languages fr

    Available in Compliance

  • Programme HospiConnect - HOP'EN2 : Sécurisation et simplification de l’accès au SIH et aux services numériques externesHospiConnect-Hopen2

    Agence du Numérique en Santé · France · Framework or guidance

    Languages fr

    Available in Compliance

  • PSSI EtatPSSI-E

    Etat Français · France · Law or regulation

    Languages fr

    Available in Compliance

  • PSSI-MCAS v1.0mcas-1.0

    MCAS · France · Framework or guidance

    Version 1.0 · Languages fr

    Available in Compliance

  • Recommandations de sécurité pour l'architecture d'un système de journalisationANSSI-REC-JOURNALISATION

    ANSSI · France · Technical configuration (benchmarks)

    Languages fr

    Available in Compliance

  • Recommandations de sécurité relatives à IPsec pour la protection des flux réseauANSSI-REC-SECU-IPSEC

    ANSSI · France · Technical configuration (benchmarks)

    Languages fr

    Available in Compliance

  • Recommandations de sécurité relatives à TLSANSSI-REC-TLS

    ANSSI · France · Technical configuration (benchmarks)

    Languages fr

    Available in Compliance

  • Recommandations de sécurité relatives à un système GNU-LinuxANSSI-REC-LINUX

    ANSSI · France · Technical configuration (benchmarks)

    Languages fr

    Available in Compliance

  • Recommandations pour la protection des systèmes d’information essentielsANSSI-REC-SIE

    ANSSI · France · Framework or guidance

    Languages fr

    Available in Compliance

  • Recommandations pour un usage sécurisé d’(Open)SSHANSSI-REC-SECU-SSH

    ANSSI · France · Technical configuration (benchmarks)

    Languages fr

    Available in Compliance

  • Recommandations relatives à l'administration sécurisée des systèmes d'informationanssi-guide-admin-securisee-si

    ANSSI · France · Framework or guidance

    Languages fr

    Available in Compliance

  • Recommandations relatives à l'interconnexion d'un système d'information à internetANSSI-REC-INTERCO-SI-INTERNET

    ANSSI · France · Technical configuration (benchmarks)

    Languages fr

    Available in Compliance

  • RECYF : RÉFÉRENTIEL CYBER France - Version 2.5 du 17/03/2026ReCyF

    ANSSI · France · Framework or guidance

    Version 2026 · Languages fr

    Available in Compliance

  • Referentiel Certification des établissements de santé pour la qualité des soinsReferentiel Certification des établissements de santé pour la qualité des soins

    Haute autorité de la santé · France · Certifiable standard

    Languages fr

    Available in Compliance

  • Référentiel Général de Sécurité 2.0 - Annexe B2ANSSI-RGS-ANNEXE-B2

    ANSSI · France · Technical configuration (benchmarks)

    Version 2.0 · Languages fr

    Available in Compliance

  • Référentiel Général de Sécurité version 2.0RGS-v2.0

    ANSSI · France · Law or regulation

    Version 2.0 · Languages fr

    Available in Compliance

  • Règles OIV - Secteur « Activités civiles de l'Etat » (2019)LPM-OIV-2019_Activites-civiles-de-l-etat

    Gouvernement français · France · Law or regulation

    Version 2019 · Languages fr

    Available in Compliance

  • Règles OIV - Secteur « Transport aérien » (2016)LPM-OIV-2016_Transport-aerien

    Gouvernement français · France · Law or regulation

    Version 2016 · Languages fr

    Available in Compliance

  • SecNumCloud v3.2 Annexe 2 : recommandations aux commanditairesSecNumCloud v3.2-A2

    ANSSI · France · Framework or guidance

    Version 3.2 · Languages fr

    Available in Compliance

Germany

  • BSI C5 Criteria Catalogue (2026)BSI-C5-2026

    BSI · Germany · Certifiable standard

    Version 2026 · Also 2020 · Languages en de

    Available in Compliance

  • IT-Grundschutz-Kompendium – Werkzeug für Informationssicherheit - APP: Anwendungenbs-it-gs-2023-app-anwendungen

    BSI · Germany · Control catalogue

    Version 2023 · Languages de

    Available in Compliance

  • IT-Grundschutz-Kompendium – Werkzeug für Informationssicherheit - CON: Konzeption und Vorgehensweisenbs-it-gs-2023-con-konzeption-und-vorgehensweisen

    BSI · Germany · Control catalogue

    Version 2023 · Languages de

    Available in Compliance

  • IT-Grundschutz-Kompendium – Werkzeug für Informationssicherheit - DER: Detektion und Reaktionbs-it-gs-2023-der-detektion-und-reaktion

    BSI · Germany · Control catalogue

    Version 2023 · Languages de

    Available in Compliance

  • IT-Grundschutz-Kompendium – Werkzeug für Informationssicherheit - IND: Industrielle ITbs-it-gs-2023-ind-industrielle-it

    BSI · Germany · Control catalogue

    Version 2023 · Languages de

    Available in Compliance

  • IT-Grundschutz-Kompendium – Werkzeug für Informationssicherheit - INF: Infrastrukturbs-it-gs-2023-inf-infrastruktur

    BSI · Germany · Control catalogue

    Version 2023 · Languages de

    Available in Compliance

  • IT-Grundschutz-Kompendium – Werkzeug für Informationssicherheit - ISMS: Sicherheitsmanagementbs-it-gs-2023-isms-sicherheitsmanagement

    BSI · Germany · Control catalogue

    Version 2023 · Languages de

    Available in Compliance

  • IT-Grundschutz-Kompendium – Werkzeug für Informationssicherheit - NET: Netze und Kommunikationbs-it-gs-2023-net-netze-und-kommunikation

    BSI · Germany · Control catalogue

    Version 2023 · Languages de

    Available in Compliance

  • IT-Grundschutz-Kompendium – Werkzeug für Informationssicherheit - OPS: Betriebbs-it-gs-2023-ops-betrieb

    BSI · Germany · Control catalogue

    Version 2023 · Languages de

    Available in Compliance

  • IT-Grundschutz-Kompendium – Werkzeug für Informationssicherheit - ORP: Organisation und Personalbs-it-gs-2023-orp-organisation-und-personal

    BSI · Germany · Control catalogue

    Version 2023 · Languages de

    Available in Compliance

  • IT-Grundschutz-Kompendium – Werkzeug für Informationssicherheit - SYS: IT-Systemebs-it-gs-2023-sys-it-systeme

    BSI · Germany · Control catalogue

    Version 2023 · Languages de

    Available in Compliance

  • Mindeststandard-des-BSI-zur-Nutzung-externer-Cloud-Dienste (Version 2.1)Mindeststandard-des-BSI-zur-Nutzung-externer-Cloud-Dienste

    BSI · Germany · Control catalogue

    Version 2.1 · Languages de

    Available in Compliance

  • Trusted Information Security Assessment Exchange (TISAX) v2027TISAX v2027

    VDA · Germany · Certifiable standard

    Version 2027 · Also 5.1, 6.0.2 · Languages en

    Available in Compliance

  • Vehicle CyberSecurity Audit (VCSA) v1.1vcsa-v1.1

    ENX · Germany · Certifiable standard

    Version 1.1 · Languages en

    Available in Compliance

Belgium

  • CCB CyberFundamentals Small - Self assessmentcyfun-small-self-assessment

    CCB · Belgium · Framework or guidance

    Languages en fr nl de

    Available in Compliance

  • CyberFundamentals 2025 (CyFun)cyfun2025

    CCB · Belgium · Framework or guidance

    Version 2025 · Also 2023 · Languages en nl fr

    Available in Compliance

United Kingdom

  • Cyber Essentials: Requirements for IT infrastructure v3.1Cyber Essentials: Requirements for IT infrastructure

    NCSC · United Kingdom · Certifiable standard

    Version 3.1 · Languages en

    Available in Compliance

  • NCSC - Cyber Assessment Framework (CAF) v4.0ncsc-caf-4.0

    NCSC · United Kingdom · Framework or guidance

    Version 4.0 · Also 3.2 · Languages en

    Available in Compliance

  • NCSC - Cyber Assessment Framework (CAF) v4.0 - IGP questionnairencsc-caf-4.0-igp

    NCSC · United Kingdom · Framework or guidance

    Version 4.0 · Languages en

    Available in Compliance

  • UK Defence Standard 05-138 Issue 4def-stan-05-138

    UK Ministry of Defence (DStan) · United Kingdom · Control catalogue

    Languages en

    Available in Compliance

United States

  • California Consumer Privacy Act (CCPA)CCPA ACT

    State of California · United States · Law or regulation

    Languages en

    Available in Compliance

  • California Consumer Privacy Act Regulations (CCPA)CCPA Regulations

    State of California · United States · Law or regulation

    Languages en

    Available in Compliance

  • CISA Cybersecurity Performance Goals v2.0CISA-CPG-2.0

    CISA · United States · Framework or guidance

    Version 2.0 · Languages en fr

    Available in Compliance

  • CMMC version 2.0CMMC-2.0

    DoD · United States · Certifiable standard

    Version 2.0 · Languages en

    Available in Compliance

  • Criminal Justice Information Services (CJIS) Security Policy 5.9.5CJIS-POLICY-5.9.5

    US CJIS · United States · Control catalogue

    Version 5.9.5 · Also 5.9.4 · Languages en

    Available in Compliance

  • GSA FedRAMP Rev5GSA-FEDRAMP-rev5

    US General Services Administration · United States · Certifiable standard

    Version Rev. 5 · Languages en

    Available in Compliance

  • ITAR Compliance Program GuidelinesITAR-Compliance-Program-Guidelines

    Directorate of Defense Trade Controls · United States · Framework or guidance

    Languages en

    Available in Compliance

  • NIST AI RMF 1.0NIST-AI-RMF-1.0

    NIST · United States · Framework or guidance

    Version 1.0 · Languages en

    Available in Compliance

  • NIST CSF 2.0 — Journey Threat and Control LibraryNIST-CSF-2.0-Journey

    NIST CSF · United States · Framework or guidance

    Version 2.0 · Languages en fr

    Available in Compliance

  • NIST CSF version 2.0NIST-CSF-2.0

    NIST · United States · Framework or guidance

    Version 2.0 · Also 1.1 · Languages en fr es

    Available in Compliance

  • NIST PRIVACY FRAMEWORK 1.0NIST-PRIVACY-1.0

    NIST · United States · Framework or guidance

    Version 1.0 · Languages en

    Available in Compliance

  • NIST SP 800-171 Rev. 3nist-800-171-rev3

    NIST · United States · Control catalogue

    Version Rev. 3 · Also Rev. 2 · Languages en

    Available in Compliance

  • NIST SP 800-53 revision 5NIST-SP-800-53-rev5

    NIST · United States · Control catalogue

    Version Rev. 5 · Languages en

    Available in Compliance

  • NIST SP 800-82 Annex FNIST-SP-800-82-Annex-F

    NIST · United States · Control catalogue

    Languages en fr

    Available in Compliance

  • NIST SP-800-66 rev2 (HIPAA)NIST-SP-800-66-rev2

    NIST · United States · Framework or guidance

    Version Rev. 2 · Languages en

    Available in Compliance

  • NY DFS 500 with 2023-11 amendmentsDFS-500-2023-11

    NEW YORK STATE · United States · Law or regulation

    Version 2023 · Languages en

    Available in Compliance

  • Secure Software Development Framework (SSDF)nist-ssdf-1.1

    NIST · United States · Framework or guidance

    Version 1.1 · Languages en

    Available in Compliance

  • SOC2-2017 Trust Services Criteria (revision 2022)SOC2-2017-Rev-2022

    AICPA · United States · Certifiable standard

    Version 2022 · Also 2017 · Languages en es

    Available in Compliance

  • Standards for Safeguarding Customer InformationStandards-for-Safeguarding-Customer-Information

    Federal Trade Commission · United States · Law or regulation

    Languages en

    Available in Compliance

  • VENDOR SUPPLY CHAIN RISK MANAGEMENT (SCRM) TEMPLATEcisa-scrm

    CISA · United States · Framework or guidance

    Languages en

    Available in Compliance

  • Zero Trust for Operational Technology Activities and Outcomes (ZT OT)DOW_ZT_OT

    The Department of War (DoW) Chief Information Officer (CIO) · United States · Framework or guidance

    Languages en

    Available in Compliance

International

  • Adobe CCF v5adobe-ccf-v5

    Adobe · International · Control catalogue

    Version v5 · Languages en

    Available in Compliance

  • Agile Security Framework - BaselineASF-Baseline

    International · Framework or guidance

    Languages en

    Available in Compliance

  • AI Defense Matrixai-defense-matrix

    AI Defense Matrix · International · Framework or guidance

    Languages en

    Available in Compliance

  • CIS Amazon Web Services Foundations Benchmarkcis-benchmark-aws-foundations

    CIS · International · Technical configuration (benchmarks)

    Languages en

    Available in Compliance

  • CIS Debian Linux 12 Benchmarkcis-benchmark-debian-12

    CIS · International · Technical configuration (benchmarks)

    Languages en

    Available in Compliance

  • CIS Debian Linux 13 Benchmarkcis-benchmark-debian-13

    CIS · International · Technical configuration (benchmarks)

    Languages en

    Available in Compliance

  • CIS GitHub Benchmarkcis-benchmark-github

    CIS · International · Technical configuration (benchmarks)

    Languages en

    Available in Compliance

  • CIS GitLab Benchmarkcis-benchmark-gitlab

    CIS · International · Technical configuration (benchmarks)

    Languages en

    Available in Compliance

  • CIS Google Cloud Platform Foundation Benchmarkcis-benchmark-gcp-foundation

    CIS · International · Technical configuration (benchmarks)

    Languages en

    Available in Compliance

  • CIS Google Workspace Foundations Benchmarkcis-benchmark-google-workspace

    CIS · International · Technical configuration (benchmarks)

    Languages en

    Available in Compliance

  • CIS Kubernetes Benchmarkcis-benchmark-kubernetes

    CIS · International · Technical configuration (benchmarks)

    Also 2.0.1 · Languages en

    Available in Compliance

  • CIS Microsoft 365 Foundations Benchmarkcis-benchmark-microsoft-365

    CIS · International · Technical configuration (benchmarks)

    Languages en

    Available in Compliance

  • CIS Microsoft Azure Foundations Benchmarkcis-benchmark-azure-foundations

    CIS · International · Technical configuration (benchmarks)

    Languages en

    Available in Compliance

  • CIS Microsoft Windows 11 Enterprise Benchmarkcis-benchmark-windows-11

    CIS · International · Technical configuration (benchmarks)

    Languages en

    Available in Compliance

  • CIS Ubuntu Linux 24.04 LTS Benchmarkcis-benchmark-ubuntu-24.04

    CIS · International · Technical configuration (benchmarks)

    Version 24.04 · Languages en

    Available in Compliance

  • Cisco Cloud Controls Framework (CCF) v3.0cisco-ccf-v3.0

    Cisco · International · Control catalogue

    Version 3.0 · Languages en

    Available in Compliance

  • Google SAIF FrameworkGoogle SAIF

    Google · International · Framework or guidance

    Languages en

    Available in Compliance

  • IEC 62443-2-1:2024 — Security program for IACS asset owners (outline)iec-62443-2-1-2024

    IEC · International · Certifiable standard

    Version 2024 · Languages en

    Available in Compliance

  • IEC 62443-2-4:2023 — Security program for IACS service providers (functional-area outline)iec-62443-2-4-2023

    IEC · International · Certifiable standard

    Version 2023 · Languages en

    Available in Compliance

  • IEC 62443-3-2:2020 — Security risk assessment for system design (outline)iec-62443-3-2-2020

    IEC · International · Certifiable standard

    Version 2020 · Languages en

    Available in Compliance

  • IEC 62443-3-3:2013 — System security requirements and security levels (outline)iec-62443-3-3-2013

    IEC · International · Certifiable standard

    Version 2013 · Languages en

    Available in Compliance

  • IEC 62443-4-1:2018 — Secure product development lifecycle requirements (outline)iec-62443-4-1-2018

    IEC · International · Certifiable standard

    Version 2018 · Languages en

    Available in Compliance

  • IEC 62443-4-2:2019 — Technical security requirements for IACS components (outline)iec-62443-4-2-2019

    IEC · International · Certifiable standard

    Version 2019 · Languages en

    Available in Compliance

  • International standard ISO/IEC 27001:2022ISO/IEC 27001:2022

    ISO/IEC · International · Certifiable standard

    Version 2022 · Also 2013 · Languages en fr cs sv es de zh

    The certificate is issued by an accredited certification body.

    Available in ComplianceIn-depth guide: International standard ISO/IEC 27001:2022

  • ISO 22301:2019 — Business continuity management systems — Requirements outlineiso22301-2019

    ISO · International · Certifiable standard

    Version 2019 · Languages en

    Available in Compliance

  • ISO 27701-2025 — Privacy information management systems — Requirements and Controls outlineiso27701-2025

    ISO · International · Certifiable standard

    Version 2025 · Languages en

    Available in Compliance

  • ISO 42001-2023 — Artificial intelligence — Requirements and Controls outlineiso42001-2023

    ISO · International · Certifiable standard

    Version 2023 · Languages en

    Available in Compliance

  • ITIL 4 Management PracticesITIL4

    AXELOS Limited · International · Framework or guidance

    Languages fr es

    Available in Compliance

  • LLM AI Cybersecurity & Governance Checklistowasp-llm-checklist

    OWASP · International · Framework or guidance

    Languages en

    Available in Compliance

  • Microsoft cloud security benchmarkmcsb-v1

    Microsoft · International · Technical configuration (benchmarks)

    Version v1 · Languages en

    Available in Compliance

  • OWASP ASVS 5.0.0OWASP-ASVS-5.0.0

    OWASP · International · Control catalogue

    Version 5.0.0 · Also 4.0.3 · Languages en

    Available in Compliance

  • OWASP MASVS 2.1.0owasp-masvs-v2.1.0

    OWASP · International · Control catalogue

    Version 2.1.0 · Languages en

    Available in Compliance

  • OWASP SAMM v2.2OWASP-SAMM-2.2

    OWASP · International · Framework or guidance

    Version 2.2 · Languages en

    Available in Compliance

  • OWASP Top 10 for Agentic Applications 2026owasp-asi-top-10-2026

    OWASP · International · Framework or guidance

    Version 2026 · Languages en

    Available in Compliance

  • Payment Card Industry Data Security Standard (PCI-DSS) 4.0.1PCI DSS 4.0.1

    PCI Security Standards Council · International · Certifiable standard

    Version 4.0.1 · Languages en fr

    Available in Compliance

  • Plumber CI/CD Security Checksplumber-cicd-checks

    Plumber · International · Technical configuration (benchmarks)

    Languages en

    Available in Compliance

  • Post-Quantum Cryptography (PQC) Migration Roadmap - May 2025pqc-migration-roadmap

    The MITRE Corporation · International · Framework or guidance

    Version 2025 · Languages en

    Available in Compliance

  • Public AirCyber Maturity Level MatrixAirCyber-v1.5.2

    Boost Aerospace · International · Framework or guidance

    Version 1.5.2 · Languages en

    Available in Compliance

  • SCF: Secure Controls Framework (2026.3)scf-2026.3

    SCF · International · Control catalogue

    Version 2026.3 · Also 2024, 2025.2.2 · Languages en

    Available in Compliance

  • Swift Customer Security Controls Framework v2025swift-cscf-v2025

    SWIFT · International · Control catalogue

    Version 2025 · Languages en

    Available in Compliance

  • UNESCO AI Maturity FrameworkUNESCO-AI-MATURITY

    UNESCO · International · Framework or guidance

    Languages en

    Available in Compliance

  • Vendor Due Diligence (VDD) - simplevendor-due-diligence

    International · Framework or guidance

    Languages fr en

    Available in Compliance

Other countries

  • [ITSP.10.171] Protecting specified information in non-Government of Canada systems and organizations - RequirementsITSP.10.171

    Centre de la sécurité des télécommunications Canada · Other countries · Control catalogue

    Languages fr en

    Available in Compliance

  • 1/2025. (I. 31.) SZTFH rendelet – Elemi követelmények (NIS2 audit)hu-1-2025-sztfh-rendelet-elemi-kovetelmenyek

    MK / SZTFH · Other countries · Law or regulation

    Version 2025 · Languages hu

    Available in Compliance

  • 7/2024. (VI. 24.) MK rendelet – Védelmi intézkedések katalógusa (NIS2)hu-7-2024-mk-rendelet

    MK · Other countries · Law or regulation

    Version 2024 · Languages hu

    Available in Compliance

  • Baseline Information Security for Government 2 (BIO2)bio2

    Rijksoverheid · Other countries · Control catalogue

    Languages en nl

    Available in Compliance

  • BCCR–SINPE NT-RCS edition 7 — category 1 — comprehensive assessmentBCCR-NT-RCS-ED7-INTEGRAL-CAT1

    Banco Central de Costa Rica · Other countries · Law or regulation

    Languages es en

    Available in Compliance

  • BCCR–SINPE NT-RCS edition 7 — category 2 — comprehensive assessmentBCCR-NT-RCS-ED7-INTEGRAL-CAT2

    Banco Central de Costa Rica · Other countries · Law or regulation

    Languages es en

    Available in Compliance

  • Cbw (NIS2) Control Framework (v1.2)Cbw_NIS2_Control_Framework

    ADR (Auditdienst Rijk) & NOREA · Other countries · Control catalogue

    Version 1.2 · Languages nl en

    Available in Compliance

  • Checklist des exigences de la Loi n° 09-08 relative à la protection des données à caractère personnelChecklist des exigences relatives à la loi 09-08

    BASSOU · Other countries · Framework or guidance

    Languages fr

    Available in Compliance

  • China Personal Information Protection Law (PIPL)china-pipl-2021

    NPC · Other countries · Law or regulation

    Version 2021 · Languages zh en

    Available in Compliance

  • China PI Protection Compliance Audit Measures and Guidelinechina-pi-compliance-audit-2025

    CAC · Other countries · Law or regulation

    Version 2025 · Languages zh en

    Available in Compliance

  • Cloud Cybersecurity Controls (CCC-1:2020)ccc-1-2020

    NCA · Other countries · Control catalogue

    Version 2020 · Languages en

    Available in Compliance

  • Controlli Minimi AGIDControlli-Minimi-AGID

    AGID · Other countries · Control catalogue

    Languages it

    Available in Compliance

  • DE TEKNISKE MINIMUMSKRAV FOR STATSLIGE MYNDIGHEDERde-tekniske-minimumskrav

    sikker digital · Other countries · Control catalogue

    Languages da

    Available in Compliance

  • Directive Nationale de la Sécurité des Systèmes d'Information (MAROC)dnssi-2023-2

    DGSSI · Other countries · Law or regulation

    Version 2023 · Languages fr

    Available in Compliance

  • E-ITS 2024e-its-2024

    RIA · Other countries · Control catalogue

    Version 2024 · Languages et

    Available in Compliance

  • Essential Cybersecurity Controls (ECC-2:2024)ecc-2-2024

    NCA · Other countries · Control catalogue

    Version 2024 · Also essential-cybersecurity-controls · Languages en

    Available in Compliance

  • Essential Eight Maturity Model (November 2023)Essential Eight 2023

    Australian Signals Directorate (ASD) · Other countries · Framework or guidance

    Version 2023 · Languages en

    Available in Compliance

  • Federal Act on Data ProtectionFADP

    Swiss confederation · Other countries · Law or regulation

    Languages en

    Available in Compliance

  • FINMA - Circular 2023/01 - Operational risks and resilience - Banksfinma-2023-01

    FINMA · Other countries · Law or regulation

    Version 2023 · Languages fr en it de

    Available in Compliance

  • Framework Nazionale per la Cybersecurity e la Data Protection (Ed. 2025, v2.1)Framework-Nazionale-C-DP

    ACN · Other countries · Framework or guidance

    Version 2025 · Also v2 · Languages it

    Available in Compliance

  • General Security Requirements for Central Government Contracts (ABRO) 2026ABRO_2026

    Government of the Netherlands · Other countries · Control catalogue

    Version 2026 · Languages nl en

    Available in Compliance

  • General Security Requirements for Defence Contracts (ABDO) 2019ABDO_2019

    Ministry of Defence of the Netherlands · Other countries · Control catalogue

    Version 2019 · Languages nl en

    Available in Compliance

  • ICT - Minimum standardict-minimal

    Swiss FONES · Other countries · Framework or guidance

    Languages en de fr it

    Available in Compliance

  • India Digital Personal Data Protection Act 2023india-dpdpa-2023

    MINISTRY OF LAW AND JUSTICE INDIA · Other countries · Law or regulation

    Version 2023 · Languages en

    Available in Compliance

  • JM 181101-02 – Reglamento de Seguridad Cibernética y de la InformaciónJM-181101-02

    Junta Monetaria de la República Dominicana · Other countries · Law or regulation

    Languages es

    Available in Compliance

  • K ISMS-P Certification Standard GuideK ISMS-P

    KISA · Other countries · Certifiable standard

    Languages en

    Available in Compliance

  • la loi n° 09-08 relative à la protection des personnes physiques à l’égard du traitement des données à caractère personnelLoi 09-08

    Royaume du Maroc · Other countries · Law or regulation

    Languages fr

    Available in Compliance

  • Lietuvos Respublikos kibernetinio saugumo įstatymo reikalavimai subjektams2024-19589

    Lietuvos Respublikos Vyriausybė · Other countries · Law or regulation

    Version 2024 · Languages lt

    Available in Compliance

  • Loi n° 05-20 relative à la cybersécuritéloi-05-20

    Royaume du Maroc · Other countries · Law or regulation

    Languages fr

    Available in Compliance

  • National Cybersecurity Controls for Non-CNI Private Sector Entities (NCNICC-1:2025)ncnicc-1-2025

    NCA · Other countries · Control catalogue

    Version 2025 · Languages en

    Available in Compliance

  • NOREA - DORA in Control Framework V3.0NOREA-DORA-in-control

    NOREA · Other countries · Control catalogue

    Version 3.0 · Languages en fr

    Available in Compliance

  • NZISM v3NSIZM-v3

    New Zealand Government Communications Security Bureau · Other countries · Control catalogue

    Version v3 · Languages en

    Available in Compliance

  • Operational Technology Cybersecurity ControlsOTCC

    Saudi Arabia's National Cybersecurity Authority · Other countries · Control catalogue

    Languages en

    Available in Compliance

  • Personal Data Protection Law (KSA)PDPL-KSA

    SDAIA · Other countries · Law or regulation

    Languages en

    Available in Compliance

  • Protective Security Policy FrameworkPSPF

    Australian Government · Other countries · Framework or guidance

    Languages en

    Available in Compliance

  • Prudential Standard CPS 230cps-230

    APRA · Other countries · Law or regulation

    Languages en

    Available in Compliance

  • Prudential Standard CPS 234cps-234

    APRA · Other countries · Law or regulation

    Languages en

    Available in Compliance

  • PSSIE du BéninPSSIE-BENIN

    ASIN BENIN · Other countries · Law or regulation

    Languages fr

    Available in Compliance

  • RBI Master Direction 2023india-rbi-itgrcap-2023

    Ministry of Finance, Government of India · Other countries · Law or regulation

    Version 2023 · Languages en

    Available in Compliance

  • Référentiel d’Audit de la Sécurité des Systèmes d’Information (ANCS Tunisie)Réferentiel-audit-SSI-ANCS-Tunisie

    ANCS Tunisie · Other countries · Framework or guidance

    Languages fr

    Available in Compliance

  • RÉFÉRENTIEL DES EXIGENCES DE QUALIFICATION DES PRESTATAIRES DE SERVICES CLOUDexigences-de-qualification-services-cloud-iiv

    Royaume du Maroc · Other countries · Certifiable standard

    Languages fr

    Available in Compliance

  • Référentiel National de Sécurité de l’Information Algérie V2020 Par EKSEC.netRNSI-ALGERIE-2020

    MPT ALGERIE · Other countries · Framework or guidance

    Version 2020 · Languages fr

    Available in Compliance

  • SAMA Cyber Security FundamentalsSAMA-CSF-1.0

    SAMA · Other countries · Framework or guidance

    Version 1.0 · Languages en

    Available in Compliance

  • T.C. CBDDO Bilgi ve İletişim Güvenliği Rehberi (BİGR)CBDDO_BIGR

    T.C. CBDDO · Other countries · Framework or guidance

    Languages tr

    Available in Compliance

Can’t see your framework, or have your own?

In Compliance you can create your own frameworks, such as an internal policy or the questionnaire a customer sends you, and map them to the same controls. What you have already proven counts from day one.

Request information