The Aegis Platform helps automate compliance across 96 global frameworks and standards

The international standard for establishing, implementing, maintaining and continually improving an information security management system (ISMS).

Implementation guidance for the 93 information security controls referenced in ISO/IEC 27001, grouped into organisational, people, physical and technological themes.

A voluntary, outcome-based framework that organises cybersecurity risk management into six functions: Govern, Identify, Protect, Detect, Respond and Recover.

The payment card industry security standard for any organisation that stores, processes or transmits cardholder data.

The UK Government-backed certification scheme that demonstrates protection against common cyber attacks through five technical controls, verified by self-assessment.

The higher level of Cyber Essentials, covering the same five controls but with hands-on technical verification carried out by an independent assessor.

A prioritised set of 18 security controls from the Center for Internet Security, organised into implementation groups for defending against the most common attacks.

A comprehensive catalogue of security and privacy controls for information systems, used by US federal agencies and widely adopted in the private sector.

Security requirements for protecting Controlled Unclassified Information (CUI) in non-federal systems, such as those operated by US government contractors.

The AICPA criteria for security, availability, processing integrity, confidentiality and privacy, used to report on the controls at service organisations.

A code of practice providing additional information security controls and guidance for cloud service providers and cloud customers.

A code of practice for protecting personally identifiable information (PII) processed by public cloud service providers.

The Cloud Security Alliance control framework for cloud computing, mapping cloud-specific security controls to leading standards and regulations.

A set of secure software development practices for reducing vulnerabilities in released software and addressing their root causes.

The UK version of the General Data Protection Regulation, setting out how organisations must collect, process and protect the personal data of people in the UK.

The European Union regulation governing the processing of personal data, with requirements on lawfulness, transparency, security and individual rights.

The UK law that sits alongside the UK GDPR, adding exemptions and covering processing by law enforcement and the intelligence services.

Requirements and guidance for a Privacy Information Management System (PIMS), extending information security management to cover the handling of personal data.

A privacy framework that defines common terminology, actors and principles for protecting personally identifiable information.

A voluntary tool that helps organisations identify and manage privacy risk while building products and services that protect individuals.

EU rules on the confidentiality of electronic communications, including consent requirements for cookies, tracking technologies and electronic marketing.

California privacy laws giving residents rights over their personal information and placing obligations on businesses that collect, share or sell it.

US requirements for administrative, physical and technical safeguards that protect electronic protected health information (ePHI).

Brazil's General Data Protection Law, regulating the processing of personal data of individuals in Brazil.

The UAE federal law setting out rules for processing personal data and the rights of data subjects.

EU regulation requiring financial entities to manage ICT risk, report major incidents, test digital resilience and oversee critical third-party ICT providers.

The EU directive that strengthens cybersecurity risk management and incident reporting obligations for essential and important entities across critical sectors.

UK regulations requiring operators of essential services and relevant digital service providers to manage security risks and report significant incidents.

FCA rules requiring firms to identify important business services, set impact tolerances and remain within them during severe but plausible disruption.

The Prudential Regulation Authority requirements for banks, building societies and insurers to remain within impact tolerances for their important business services.

UK regulatory expectations for managing outsourcing and third-party risk, including due diligence, contractual safeguards, exit planning and ongoing oversight.

Mandatory and advisory security controls that SWIFT users attest to annually to protect their local SWIFT infrastructure.

Guidance used by US financial regulators to examine institutions' information technology, covering areas such as information security, business continuity and outsourcing.

The New York cybersecurity regulation requiring regulated financial services companies to maintain a cybersecurity programme, controls and incident reporting.

Requirements for the secure management, processing and transmission of PIN data in payment card transactions at ATMs and point-of-sale terminals.

Security requirements for organisations that perform or provide 3-D Secure functions used to authenticate card-not-present transactions.

EU payment services rules, including strong customer authentication and secure communication requirements for payment service providers.

The UK Ministry of Defence certification scheme for verifying that defence suppliers meet cyber security requirements proportionate to contract risk.

The MOD cyber security standard for defence suppliers, setting out the controls required at each cyber risk profile level.

The US Department of Defense programme that verifies contractors have implemented the cybersecurity practices needed to protect federal contract information and CUI.

Enhanced security requirements that supplement NIST SP 800-171 to protect CUI in critical programmes against advanced persistent threats.

The UK Government framework of protective security requirements for departments and their suppliers, covering governance, information, physical and personnel security.

The NCSC outcome-based framework for assessing how well organisations responsible for essential functions manage cyber risk.

The baseline cyber security measures that UK government departments and their suppliers are expected to meet.

UK Government and NCSC guidance setting out the actions boards and directors should take to govern cyber risk.

The US government programme that standardises security assessment, authorisation and continuous monitoring for cloud services used by federal agencies.

The US law requiring federal agencies and the organisations that support them to develop, document and implement information security programmes.

The FBI security requirements for protecting criminal justice information accessed by law enforcement agencies and their vendors.

The Australian Cyber Security Centre's eight prioritised mitigation strategies, with maturity levels, for defending against cyber threats.

The Australian Government cybersecurity framework of controls for protecting systems and data from cyber threats.

The Canadian Centre for Cyber Security guidance on managing IT security risk, including a catalogue of security controls.

International guidelines for managing risk of any kind, providing principles, a framework and a process that apply to any organisation.

Guidance on information security risk management that supports the risk assessment and treatment requirements of ISO/IEC 27001.

The international standard specifying requirements for a business continuity management system (BCMS).

Guidance on implementing and operating a business continuity management system in line with ISO 22301.

A multi-part standard for information security incident management, covering planning, detection, reporting, response and lessons learned.

Guidance on ICT readiness for business continuity, helping ensure technology services can withstand and recover from disruption.

Principles and attributes for enhancing organisational resilience, helping organisations anticipate, respond and adapt to change.

A widely used framework that integrates enterprise risk management with strategy setting and performance.

The ISACA framework for the governance and management of enterprise information and technology.

A structured process for integrating security, privacy and supply chain risk management activities into the system development life cycle.

The international standard specifying requirements for establishing, developing, maintaining and improving a compliance management system.

The international standard for anti-bribery management systems, helping organisations prevent, detect and respond to bribery.

A series of standards for securing industrial automation and control systems (IACS), covering asset owners, system integrators and product suppliers.

Information security controls for the energy utility industry, extending ISO/IEC 27002 to process control systems.

Mandatory reliability standards for protecting the cyber assets that support the bulk electric system in North America.

Guidance on securing operational technology, including industrial control systems, SCADA and building automation systems.

The EU directive requiring critical entities to assess risks and take measures to strengthen their resilience against disruptive incidents.

US Transportation Security Administration directives requiring critical pipeline owners and operators to implement cybersecurity measures and report incidents.

The UN regulation requiring vehicle manufacturers to operate a certified cyber security management system as part of vehicle type approval.

The UN regulation requiring vehicle manufacturers to operate a software update management system, including for over-the-air updates.

The automotive standard for cybersecurity risk management across the lifecycle of road vehicle electrical and electronic systems.

The functional safety standard for safety instrumented systems in the process industry, which requires a security risk assessment of those systems.

The international standard for an AI management system, supporting the responsible development, provision and use of artificial intelligence.

Guidance on managing the risks specific to the development and use of artificial intelligence.

A voluntary framework that helps organisations govern, map, measure and manage the risks of AI systems.

The EU regulation that places risk-based obligations on providers and deployers of AI systems, with the strictest requirements for high-risk AI.

A detailed set of security requirements for designing, building and testing web applications and services.

A maturity model for assessing and improving an organisation's software security practices across the development life cycle.

The widely recognised awareness document listing the most critical security risks to web applications.

The most critical security risks for applications built on large language models, such as prompt injection and sensitive information disclosure.

Guidance on integrating information security into the processes used to manage applications throughout their life cycle.

A data-driven model of the software security activities observed in real-world organisations, used to benchmark your own programme.

A framework of incremental levels for securing the software supply chain and protecting the integrity of build artefacts.

The annual online self-assessment that organisations with access to NHS patient data and systems complete to show they meet the national data security standards.

The NHS baseline criteria for assessing digital health technologies across clinical safety, data protection, technical security, interoperability, usability and accessibility.

The quality management system standard for medical devices, where cybersecurity is addressed through design controls and risk management.

US FDA expectations for medical device cybersecurity, including premarket submissions, software bills of materials and postmarket vulnerability management.

The automotive industry information security assessment and exchange mechanism, based on the VDA Information Security Assessment catalogue.

The international standard for quality management systems, helping organisations consistently meet customer and regulatory requirements.

The international standard specifying requirements for an IT service management system.

Singapore law placing obligations on owners of critical information infrastructure, including audits, risk assessments and incident reporting.

The Saudi National Cybersecurity Authority minimum cybersecurity requirements for government and critical national infrastructure organisations.

The UAE standard setting management and technical information security controls for government entities and critical sectors.

The Dubai Government regulation setting information security requirements for Dubai government entities.

India's 2023 law governing the processing of digital personal data, setting obligations for data fiduciaries and rights for individuals.