Certifiable standard
ISO/IEC 27001
The international, certifiable standard for building, running and continually improving an information security management system (ISMS).
Framework directory
Compliance Academy
Standards, laws and programmes explained in plain language: what each one is, who it applies to, what it requires and how the pieces fit together.
Showing all 39 frameworks.
Information security & management systems
ISO/IEC management-system standards and the control sets that support them.
SOC reporting & assurance
Independent attestation reports on controls at service organisations.
Attestation framework
SOC 2
An independent CPA examination that reports on how a service organisation's controls meet the AICPA Trust Services Criteria.
US federal & defence
Security requirements for federal agencies, cloud providers and the defence supply chain.
Government programme
CMMC
The US defence programme that verifies whether contractors protect Federal Contract Information and Controlled Unclassified Information. Phase 2 was suspended in July 2026 pending a programme review.
Government programme
FedRAMP
The US government programme that standardises security assessment and authorisation of cloud services used by federal agencies, now moving from Rev5 baselines to the automation-focused FedRAMP 20x model.
Guidance standard Profile
NIST SP 800-53
The US federal catalogue of security and privacy controls, used to protect federal information systems and as the basis of FedRAMP and many other programmes.
Healthcare & health information
Rules and frameworks protecting health information.
Law / regulation
HIPAA
US federal law and HHS rules protecting the privacy and security of protected health information held by covered entities and their business associates.
Payment security
Industry standards for protecting payment account data.
Industry standard
PCI DSS
The global industry standard of technical and operational requirements for any entity that stores, processes or transmits payment account data, or can affect its security.
AI governance & AI security
Standards, voluntary frameworks and laws for trustworthy, accountable AI.
Law / regulation
EU AI Act
The European Union's binding, risk-based law for AI systems and general-purpose AI models, with obligations that vary by risk level and by role.
Certifiable standard
ISO/IEC 42001
The first certifiable international standard for an AI management system (AIMS): how an organisation governs the AI systems it develops, provides or uses.
Voluntary framework
NIST AI RMF
NIST's voluntary framework for managing the risks of AI systems, organised around four functions: Govern, Map, Measure and Manage.
Privacy & data protection
Data protection laws and privacy management standards across jurisdictions.
Law / regulation
DPDP Act (India)
India's data protection law for digital personal data, made operational by the DPDP Rules, 2025, which come into force in phases until May 2027.
Law / regulation
GDPR
The EU's comprehensive data protection law, setting principles, lawful bases, individual rights and accountability duties for anyone processing personal data in its scope.
Certifiable standard
ISO/IEC 27701
The international standard for a privacy information management system (PIMS). Since its 2025 edition it can be implemented and certified on its own, without ISO/IEC 27001.
Law / regulation Profile
APPI
Japan's data protection law, administered by the Personal Information Protection Commission, with mandatory breach reporting and cross-border transfer rules.
Law / regulation Profile
CCPA / CPRA
California's consumer privacy law, giving residents rights over their personal information and imposing duties on businesses that meet its thresholds.
Law / regulation Profile
Kenya Data Protection Act
Kenya's comprehensive data protection law, enforced by the Office of the Data Protection Commissioner, with registration and 72-hour breach notification.
Law / regulation Profile
LGPD
Brazil's general data protection law, closely modelled on the GDPR and enforced by the national data protection authority, the ANPD.
Law / regulation Profile
NDPA
Nigeria's data protection law, which established the Nigeria Data Protection Commission and set duties for data controllers and processors.
Law / regulation Profile
PDPA (Singapore)
Singapore's main personal data protection law, administered by the Personal Data Protection Commission, including mandatory breach notification.
Law / regulation Profile
PIPA (South Korea)
South Korea's comprehensive data protection law, overseen by the Personal Information Protection Commission and substantially amended in 2023.
Law / regulation Profile
PIPEDA
Canada's federal private-sector privacy law, built on ten fair information principles and overseen by the Office of the Privacy Commissioner of Canada.
Law / regulation Profile
PIPL
China's comprehensive personal information law, in force since November 2021, with strict rules on consent, sensitive information and cross-border transfers.
Law / regulation Profile
POPIA
South Africa's data protection law, built on eight conditions for lawful processing and enforced by the Information Regulator.
Law / regulation Profile
Privacy Act 1988 (Australia)
Australia's federal privacy law, built on 13 Australian Privacy Principles and the Notifiable Data Breaches scheme, administered by the OAIC.
Law / regulation Profile
Privacy Act 2020 (New Zealand)
New Zealand's privacy law, built on information privacy principles, with mandatory notification of serious privacy breaches, overseen by the Privacy Commissioner.
Law / regulation Profile
Saudi PDPL
Saudi Arabia's comprehensive personal data protection law, supervised by the Saudi Data and Artificial Intelligence Authority (SDAIA).
Law / regulation Profile
UAE PDPL
The UAE's federal personal data protection law, with separate regimes in financial free zones such as DIFC and ADGM.
Law / regulation Profile
UK GDPR
The United Kingdom's data protection framework: the retained GDPR plus the Data Protection Act 2018, enforced by the Information Commissioner's Office.
Cybersecurity frameworks & operations
Outcome frameworks, control catalogues and operational security practice.
Voluntary framework
NIST CSF 2.0
NIST's voluntary, outcome-based framework for understanding, assessing, prioritising and communicating cybersecurity risk, organised into six functions including the new Govern function.
Law / regulation Profile
CERT-In Directions
India's mandatory cyber incident reporting rules: specified incidents must be reported to CERT-In within six hours, with log retention and clock synchronisation duties.
Law / regulation Profile
Cyber Resilience Act
The EU regulation that requires hardware and software products with digital elements to be secure by design and supported with security updates for their lifetime.
Voluntary framework Profile
Essential Eight
The Australian Signals Directorate's eight prioritised mitigation strategies against cyber threats, with a maturity model from level zero to three.
Law / regulation Profile
NCA ECC
Saudi Arabia's baseline cybersecurity controls for government bodies and operators of critical national infrastructure, issued by the National Cybersecurity Authority.
Law / regulation Profile
NIS2
The EU directive that sets cybersecurity risk-management, governance and incident-reporting duties for essential and important entities in critical sectors.
Financial & critical sectors
Operational resilience and cybersecurity rules for regulated sectors.
Law / regulation Profile
DORA
The EU regulation that sets one rulebook for ICT risk management, incident reporting, resilience testing and ICT third-party risk across the financial sector.
Law / regulation Profile
IRDAI cyber security guidelines
The Insurance Regulatory and Development Authority of India's guidelines on information and cyber security for insurers and insurance intermediaries.
Guidance standard Profile
MAS TRM Guidelines
The Monetary Authority of Singapore’s guidelines on technology and cyber risk management for financial institutions, backed by binding notices on incidents and cyber hygiene.
Law / regulation Profile
RBI cyber security directions
The Reserve Bank of India's requirements for banks and other regulated entities on IT governance, cyber security, resilience and incident reporting.
Law / regulation Profile
SEBI CSCRF
The Securities and Exchange Board of India's graded cybersecurity and cyber resilience framework for stock exchanges, intermediaries and other regulated entities.
No frameworks match those filters.
Research roadmap
Topics being researched
These frameworks are in the Academy registry and are being researched against official sources. They are listed for transparency and will get their own guides once they pass editorial review.
Information security
- ISO 22301
- ISO 9001
- ISO/IEC 20000-1
- ISO/IEC 27002
- ISO/IEC 27005
- ISO/IEC 27017
- ISO/IEC 27018
SOC & assurance
- SOC 1
- SOC 3
US federal
- CJIS Security Policy
- FIPS 140-3
- FISMA
- GovRAMP
- ITAR cybersecurity
- NIST SP 800-171
Healthcare
- HITECH Act
- HITRUST CSF
Payments
- PCI Secure Software Framework
AI governance
- AI security and threat modelling
Privacy
- US state privacy laws
Cyber frameworks
- Business continuity & disaster recovery
- CIS Critical Security Controls
- COBIT
- CSA Cloud Controls Matrix & STAR
- Incident response
- OWASP Top 10
- SABSA
- Third-party risk management
- Vulnerability management
Sector rules
- SWIFT Customer Security Programme