50+ standards & best practices, one control set

Risk tiering, transparency and post-market monitoring for AI systems placed on the EU market.

The AI management system standard — governance, impact assessment and lifecycle control.

Govern, map, measure and manage AI risk across the model lifecycle.

The canonical list of LLM-native failure modes, from prompt injection to excessive agency.

Adversarial tactics and techniques observed against machine learning systems.

The 2026 Agentic Security Initiative list — goal hijack, tool misuse, rogue agents and the rest of what breaks once a model can act.

Singapore's testing framework for trustworthy AI.

Information security management system certification.

Trust services criteria for security, availability and confidentiality.

Cardholder data protection across storage, processing and transmission.

Safeguards for protected health information.

The HITRUST CSF — a certifiable control framework that harmonises HIPAA, ISO, NIST and PCI for healthcare and its vendors.

Lawful basis, data subject rights and processor obligations.

India's Digital Personal Data Protection Act — consent, notice and breach reporting.

Hardening baselines for cloud services, Kubernetes and operating systems.

Identify, protect, detect, respond, recover — plus the new govern function.

The federal control catalogue — the control families FedRAMP and most US public-sector baselines are built from.

Authorisation baseline for cloud services sold to US federal agencies.

California consumer privacy rights and opt-out obligations.

Electronic records and signatures in regulated life sciences.

Baseline practices for critical infrastructure operators.

The superseded revision, still the certified baseline for organisations mid-transition.

The Cloud Security Alliance control set, mapped across the shared-responsibility line.

Germany's cloud computing compliance criteria catalogue.

US Department of Energy cybersecurity capability maturity model.

Brazil's general data protection law — consent, rights and controller duties.

Korea's information security and personal information management certification.

EudraLex Volume 4 Annex 11 — computerised systems in EU-regulated pharmaceutical manufacturing.

Adversarial tactics and techniques observed against enterprise IT — distinct from ATLAS, which covers ML systems.

Protecting controlled unclassified information in non-federal systems — the baseline behind CMMC.

The HIPAA Security Rule read as a NIST control mapping.

AWS's own security control set — the baseline the Foundational Technical Review is scored against.

AWS Well-Architected's security pillar — identity, detection, infrastructure and data protection.

AWS Well-Architected's reliability pillar — recovery, change management and workload architecture.

AWS Control Tower's preventive and detective guardrails across a multi-account landing zone.

AWS's baseline for bringing a new account into a governed multi-account estate.

The AWS Partner Network's technical bar for a solution listed in the AWS Marketplace.

Reserve Bank of India directions for banks and regulated entities.

Cybersecurity and cyber resilience framework for India's market infrastructure.

Information and cyber security guidelines for Indian insurers.

Digital operational resilience for EU financial entities and their ICT providers.

Security and reporting duties for essential and important entities across the EU.

Technology risk management guidelines for Singapore financial institutions.

Information security prudential standard for Australian regulated entities.

ACSC mitigation strategies and maturity levels.

Cybersecurity assessment for US financial institutions.

BaFin supervisory requirements for IT in German banks and insurers.

The Australian Signals Directorate's Information Security Manual.

The UK government's baseline cyber hygiene certification, assessed by IASME on behalf of the NCSC.

The Reserve Bank of India's cyber security framework for urban co-operative banks.

Kuwait's telecoms and IT regulator's data privacy protection regulation.

The UK NCSC's outcome-based framework for assessing cyber resilience in essential services.