Security Lights the Way

Free downloads

Toolkits

One-page readiness cheat sheets, built from the Compliance Academy guides in plain language. Each one downloads as a PDF — nothing is uploaded, nothing is asked for.

  • DPDP Act (India)

    Any Data Fiduciary processing digital personal data in India, or outside India when that processing is connected to offering goods or services to people in India.

    View the cheat sheet →

  • EU AI Act

    Any organisation that develops, deploys, imports or distributes AI systems or general-purpose AI models used in the EU, or whose AI output is used there — wherever the organisation is based.

    View the cheat sheet →

  • GDPR

    Any organisation processing personal data of people in the EU/EEA, or based outside it but offering goods or services to them, or monitoring their behaviour there.

    View the cheat sheet →

  • ISO/IEC 27001

    Any organisation building or certifying an information security management system (ISMS) — most often SaaS and technology vendors, and outsourced or managed-service providers answering customer security questionnaires.

    View the cheat sheet →

  • ISO/IEC 42001

    Any organisation that develops, provides or uses AI systems and wants a structured, auditable AI governance programme.

    View the cheat sheet →

  • NIST CSF 2.0

    Any organisation, of any size, sector or country, that wants a shared vocabulary to describe its cybersecurity posture and communicate it to leadership.

    View the cheat sheet →

  • PCI DSS

    Any entity that stores, processes or transmits cardholder data or sensitive authentication data, or that could affect the security of the cardholder data environment.

    View the cheat sheet →

  • SOC 2

    Service organisations — cloud/SaaS providers, data centres, managed IT and other providers handling sensitive data for clients — whose customers want independent assurance over their controls.

    View the cheat sheet →

  • CMMC

    Any defence contractor or subcontractor in the US defence industrial base that processes, stores or transmits Federal Contract Information or Controlled Unclassified Information on contractor systems.

    View the cheat sheet →

  • FedRAMP

    Cloud service providers (IaaS, PaaS or SaaS) that want US federal agencies to use their offerings.

    View the cheat sheet →

  • HIPAA

    US covered entities (health plans, clearinghouses, most providers) and their business associates that create, receive, maintain or transmit protected health information.

    View the cheat sheet →

  • ISO/IEC 27701

    Any organisation that processes personally identifiable information as a controller, a processor, or both, and wants a structured, auditable privacy programme.

    View the cheat sheet →

  • NIST AI RMF

    Any organisation designing, developing, deploying, evaluating or using AI systems that wants a voluntary, flexible way to manage AI risk — including teams not ready for a certifiable standard.

    View the cheat sheet →