By jurisdiction
Chart Room Know what applies where
Cybersecurity, AI governance and privacy frameworks, grouped by the country or region they apply in. Each one links to its MajorCyber™ page, which links on to the official source.
Showing all 42 entries across 19 jurisdictions.
International 7
- ISO/IEC 27001 Certifiable standard Information security ISO/IEC 27001:2022, amended by ISO/IEC 27001:2022/Amd 1:2024 (climate change considerations). The 2013 edition's certification transition has ended. Reviewed 17 October 2026
- ISO/IEC 27701 Certifiable standard Privacy ISO/IEC 27701:2025 (published October 2025) replaces the 2019 edition and is now a standalone management-system standard. Reviewed 17 October 2026
- ISO/IEC 42001 Certifiable standard AI governance ISO/IEC 42001:2023, first edition (December 2023). Supporting standards include ISO/IEC 42005 (impact assessment) and ISO/IEC 42006 (certification bodies). Reviewed 17 October 2026
- NIST AI RMF Voluntary framework AI governance AI RMF 1.0 (NIST AI 100-1, January 2023), with the Generative AI Profile (NIST AI 600-1, July 2024) and the online AI RMF Playbook. Reviewed 17 October 2026
- NIST CSF 2.0 Voluntary framework Cyber frameworks CSF 2.0, published 26 February 2024 (NIST CSWP 29), with online quick-start guides, implementation examples and informative references. Reviewed 17 October 2026
- PCI DSS Industry standard Payments PCI DSS v4.0.1 (June 2024) is the active version. Requirements that were future-dated in v4.0 became mandatory on 31 March 2025. Reviewed 17 October 2026
- SOC 2 Attestation framework SOC & assurance Examinations use the 2017 Trust Services Criteria with revised points of focus (2022) and the DC 200 description criteria. Reviewed 17 October 2026
European Union 5
- Cyber Resilience Act Law / regulation Cyber frameworks In force since 10 December 2024. Vulnerability and incident reporting applies from 11 September 2026; most other duties from 11 December 2027. Reviewed 19 October 2026
- DORA Law / regulation Sector rules Applies since 17 January 2025, with detailed rules in regulatory and implementing technical standards. Reviewed 19 October 2026
- EU AI Act Law / regulation AI governance In force since 1 August 2024. Amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI, OJ 24 July 2026), which moved the main high-risk deadlines to 2027–2028. Reviewed 17 October 2026
- GDPR Law / regulation Privacy In application since 25 May 2018. The European Commission proposed targeted amendments in its November 2025 Digital Omnibus; these are not law unless and until adopted. Reviewed 17 October 2026
- NIS2 Law / regulation Cyber frameworks In force; member states had to transpose it by 17 October 2024. Duties apply through each national law. Reviewed 19 October 2026
India 5
- CERT-In Directions Law / regulation Cyber frameworks In force since 28 June 2022, with FAQs issued by CERT-In clarifying scope. Reviewed 19 October 2026
- DPDP Act (India) Law / regulation Privacy Act passed in August 2023. Rules notified 13 November 2025 (G.S.R. 846(E)). Board provisions in force; consent-manager rule from November 2026; most obligations from May 2027. Reviewed 17 October 2026
- IRDAI cyber security guidelines Law / regulation Sector rules Issued April 2023, replacing the 2017 guidelines; insurers were given a transition period to comply. Reviewed 19 October 2026
- RBI cyber security directions Law / regulation Sector rules The Master Direction on IT Governance, Risk, Controls and Assurance Practices (November 2023) has applied since 1 April 2024, alongside earlier cyber security frameworks. Reviewed 19 October 2026
- SEBI CSCRF Law / regulation Sector rules Issued 20 August 2024, replacing earlier SEBI cyber circulars; compliance timelines have since been extended for some categories. Reviewed 19 October 2026
United States 7
- CMMC Government programme US federal Phase 1 (self-assessments) in effect since 10 November 2025. On 13 July 2026 the Department suspended Phase 2 (C3PAO certification at award), and later phases, pending a 60-day review. Reviewed 17 October 2026
- FedRAMP Government programme US federal In transition: FedRAMP 20x is the go-forward path (Phase 3 since April 2026); existing Rev5 authorizations continue. New Rev5 submissions are due to close on 11 June 2027 (estimate). Reviewed 17 October 2026
- HIPAA Law / regulation Healthcare Security Rule (2003, as amended in 2013) remains in force. HHS proposed a major Security Rule update in January 2025; it had not been finalised when this page was reviewed. Reviewed 17 October 2026
- NIST AI RMF Voluntary framework AI governance AI RMF 1.0 (NIST AI 100-1, January 2023), with the Generative AI Profile (NIST AI 600-1, July 2024) and the online AI RMF Playbook. Reviewed 17 October 2026
- NIST CSF 2.0 Voluntary framework Cyber frameworks CSF 2.0, published 26 February 2024 (NIST CSWP 29), with online quick-start guides, implementation examples and informative references. Reviewed 17 October 2026
- NIST SP 800-53 Guidance standard US federal Revision 5 is current, with periodic minor updates to the catalogue; baselines are published separately in SP 800-53B. Reviewed 19 October 2026
- SOC 2 Attestation framework SOC & assurance Examinations use the 2017 Trust Services Criteria with revised points of focus (2022) and the DC 200 description criteria. Reviewed 17 October 2026
California (US) 1
United Kingdom 1
Canada 1
Brazil 1
Saudi Arabia 2
- NCA ECC Law / regulation Cyber frameworks First issued as ECC-1:2018 and updated as ECC-2:2024; NCA assesses compliance through its regulatory programme. Reviewed 19 October 2026
- Saudi PDPL Law / regulation Privacy In force since 14 September 2023, with a one-year grace period to 14 September 2024; implementing and transfer regulations apply. Reviewed 19 October 2026
United Arab Emirates 1
Kenya 1
Nigeria 1
South Africa 1
Singapore 2
- MAS TRM Guidelines Guidance standard Sector rules Guidelines revised January 2021; binding MAS Notices on technology risk management and cyber hygiene apply alongside them. Reviewed 19 October 2026
- PDPA (Singapore) Law / regulation Privacy In force since 2014; amended in 2020, adding mandatory breach notification (from 2021) and higher penalties (from 2022). Reviewed 19 October 2026
China 1
South Korea 1
Japan 1
Australia 2
- Essential Eight Voluntary framework Cyber frameworks Maturity Model updated periodically by ASD; non-corporate Commonwealth entities are required to implement it under the Protective Security Policy Framework. Reviewed 19 October 2026
- Privacy Act 1988 (Australia) Law / regulation Privacy In force; amended by the Privacy and Other Legislation Amendment Act 2024, with some changes commencing later. Further reforms are under consideration. Reviewed 19 October 2026
New Zealand 1
No entries match those filters
Try a different jurisdiction or clear the filters.