Compliance frameworks, explained in plain English

The international standard for running an information security management system. Certifiable by an accredited auditor.

Guidance on managing risk across an organisation. A guideline, not a certification.

The European Union law on handling personal data. Applies to anyone serving people in the EU.

India’s Digital Personal Data Protection Act. Sets duties for handling the personal data of people in India.

Guidance on security threats to AI systems and how to address them.

A certifiable standard for managing AI responsibly inside an organisation.

European Union law that sets rules for AI systems according to their level of risk.

An audit report on how a service provider protects customer data.

An extension to ISO 27001 for managing personal data. Certifiable.

Security requirements for any business that stores, processes or sends payment card data.

United States law that protects health information held by healthcare providers and their partners.

A short, prioritised list of security actions that stop the most common attacks.

European Union law setting cybersecurity duties for essential and important organisations.

Guidance on applying risk management to AI systems.

A certifiable standard for keeping the business running through disruption.

A certifiable standard for a system that tracks and meets compliance obligations.

Cloud security and cloud privacy controls that extend ISO 27001.

A public registry where cloud providers show how they meet cloud security controls.

A framework for governing enterprise IT and linking it to business goals.

A framework that links enterprise risk to strategy and performance.

IT controls that support financial reporting for US-listed companies.

European Union rules on digital resilience for financial firms and their ICT providers.

The United Kingdom’s data protection law, working alongside the Data Protection Act 2018.

California privacy law giving residents control over their personal information.

Singapore’s data protection law, built on consent, purpose and protection.

Brazil’s general data protection law, closely modelled on the GDPR.

CERT-In, RBI and SEBI security and incident reporting rules in India.

How Ireland and other countries enforce the EU AI Act and add national rules.

The Central Bank of the UAE's rules on operational risk, resilience, ICT and cybersecurity, third parties and outsourcing for licensed financial institutions.

The UK government-backed scheme that certifies the five basic technical controls every organisation should have in place.

The EU law that sets cybersecurity rules for hardware and software products sold in the EU, from design through security updates.

The EU law on who can access and use data from connected products and services, and on switching between cloud providers.

Singapore's central bank guidance on managing technology and cyber risk, with binding notices for banks, insurers and other regulated firms.

New York's cybersecurity regulation for banks, insurers and other firms licensed by the state financial regulator.

The Reserve Bank of India's directions on IT governance, risk, controls and assurance for banks, larger NBFCs and similar entities.

SEBI's cybersecurity and cyber resilience framework for entities regulated in India's securities market. It sets standards by entity size.

The UAE's federal personal data protection law. It sets duties for handling personal data and rights for the people it concerns.