Security standards, frameworks, and regulations
Quick reference guides for the main security standards, frameworks, and data protection laws. Essential knowledge for enterprise security, audits, and certification exams.
ISO/IEC 27001
The international ISMS standard: 93 Annex A controls and certification
🏛️NIST Cybersecurity Framework
CSF 2.0: 6 functions including the new Govern function
📋CIS Controls
The 18 Critical Security Controls with implementation guidance
💳PCI DSS Checklist
Payment card security requirements and compliance checklist
✅SOC 2 Basics
Trust Service Criteria: Security, Availability, Confidentiality
🇪🇺GDPR for Developers
Data protection principles, user rights, and implementation guide
🏥HIPAA Security Guide
Healthcare data protection requirements and compliance checklist
🏦Financial Services Compliance
GLBA, NYDFS Part 500, DORA, and SOX 404: which regulations apply to your firm
🤝Third-Party Risk Management
TPRM lifecycle, vendor tiering, due diligence checklist, and contractual controls
📊Risk Register Guide
Risk scoring methodology, 5x5 matrix, sample entries, and framework alignment
Which framework applies?
| Framework | Use it when |
|---|---|
| ISO/IEC 27001 | Customers or partners, often outside the US, ask for a certificate from an accredited body proving you run an information security management system (ISMS) |
| NIST CSF 2.0 | Building or measuring an enterprise security program across six functions, including Govern |
| CIS Controls | Prioritizing 18 CIS Controls (v8.1) and their safeguards, from asset inventory through incident response and penetration testing |
| PCI DSS | Storing, processing, or transmitting cardholder or sensitive authentication data, or running systems that could affect that environment. Required by contract with card brands or your acquirer. No federal law mandates it, though some states reference it in statute (Nevada NRS 603A.215, for example). |
| SOC 2 | Customers or partners need an independent CPA-firm attestation report (SOC 2 Type I or Type II) on your service organization's controls |
| GDPR | Your organization has an establishment in the EU, or you are based outside the EU but offer goods or services to people in the EU or monitor their behavior within the EU (Art. 3) |
| HIPAA | Required for covered entities (health plans, healthcare clearinghouses, and health care providers that transmit health information electronically in a HIPAA standard transaction, such as billing insurers) and their business associates that handle US protected health information |
| Financial services | Non-bank lenders and tax preparers, New York-licensed firms, EU financial entities, and SEC-reporting companies. GLBA, NYDFS Part 500, DORA, and SOX 404 each apply to different firms |
| Third-party risk | Vetting and tiering vendors that touch your data or systems |
| Risk register | Recording, scoring, and tracking risks for a program built on ISO 27001, NIST CSF, or SOC 2 |
Stay Updated
Get weekly security tips, compliance updates, and regulatory alerts.
No spam. Unsubscribe anytime.
Need Detailed Compliance Guides?
For in-depth compliance tutorials, implementation checklists, and audit preparation:
Browse all guides →