The compliance landscape, decoded.

The world's best-known standard for a certifiable Information Security Management System (ISMS).

ISO/IEC 27001 defines requirements for establishing, operating, and continually improving an ISMS — a management system for how an organization identifies risks and applies controls to protect the confidentiality, integrity, and availability of information. The companion Annex A control set (aligned with ISO/IEC 27002) provides the reference controls. An accredited body audits you and, if you pass, issues a certificate valid for three years with annual surveillance audits.

An independent auditor's report on how well your controls meet the Trust Services Criteria.

SOC 2 (governed by the AICPA) is not a certification but an attestation: a licensed CPA firm examines your controls against up to five Trust Services Criteria — Security (always required), Availability, Confidentiality, Processing Integrity, and Privacy — and issues a report. Type I assesses design at a point in time; Type II assesses operating effectiveness over a period (typically 3–12 months). The report is shared under NDA with customers and prospects.

A prioritized, practical answer to "what should we secure first?"

The CIS Critical Security Controls are a consensus-built, prioritized set of best practices maintained by the Center for Internet Security. The current release, v8.1 (June 2024), organizes 153 safeguards across 18 controls and adds a Govern function aligned to NIST CSF 2.0. Safeguards are grouped into three Implementation Groups: IG1 (56 safeguards — "essential cyber hygiene" for small orgs), IG2, and IG3 (full set, for high-risk/regulated orgs).

Step-by-step hardening recipes for specific platforms.

Distinct from the Controls, CIS Benchmarks are prescriptive configuration recommendations for concrete systems — Linux/Windows, AWS/Azure/GCP accounts, Kubernetes, databases, browsers, and more. Where Controls say what to do strategically, Benchmarks say how to configure a given system. The recurring challenge is configuration drift, which is why benchmark checking is a continuous activity.

A risk-management framework that structures security around six functions.

NIST CSF organizes cybersecurity into Govern, Identify, Protect, Detect, Respond, Recover. CSF 2.0 (2024) added Govern and is explicitly intended for organizations of any size or sector. It's outcome-oriented rather than prescriptive — it tells you what good looks like and lets you choose how to get there, which makes it a strong common language across teams and with leadership.

A very large, granular catalog of security and privacy controls.

A comprehensive control catalog (organized into families such as Access Control, Audit, Incident Response) used where deep, rigorous control coverage is required. It underpins US federal compliance regimes (e.g., FedRAMP) and is common in heavily regulated environments.

The automotive industry's shared information-security assessment.

TISAX (operated by the ENX Association) is an assessment and result-exchange mechanism built on an automotive-specific catalog (VDA ISA). You get assessed once, receive a label, and can share the result with multiple automotive partners instead of being audited repeatedly by each.

Germany's structured methodology for building an ISMS.

Published by the German Federal Office for Information Security (BSI), IT-Grundschutz is a detailed methodology plus a large catalog of standard modules and safeguards. It is designed to be compatible with ISO/IEC 27001 — you can achieve "ISO 27001 certification on the basis of IT-Grundschutz."

The security standard for handling payment-card data.

Maintained by the PCI Security Standards Council, PCI DSS is a framework for safely storing, processing, and transmitting cardholder data. Validation ranges from a Self-Assessment Questionnaire (SAQ) for smaller merchants to a Report on Compliance (ROC) by a QSA for large volumes.

A cloud-specific control matrix for assessing cloud security.

From the Cloud Security Alliance, the CCM is a cybersecurity control framework tailored to cloud computing, organized into domains and mapped to other standards. It underlies the CSA STAR program for cloud-provider assurance.

The reference for building and testing secure applications.

The OWASP Top 10 is an awareness list of the most critical web-application risks. The Application Security Verification Standard (ASVS) is a detailed, leveled set of requirements for verifying the technical security controls of web apps and APIs. Together they guide secure coding, code review, and penetration testing.

A governance and management framework for enterprise IT.

From ISACA, COBIT frames how IT is governed and managed to deliver value and manage risk. It's used more by IT governance, audit, and risk functions than by hands-on security engineers.

The cybersecurity standard for industrial and OT environments.

A series of standards for the security of industrial automation and control systems (IACS/OT) — covering asset owners, integrators, and product suppliers across plants, ICS, and connected machinery.

These are laws and regulations — not optional guidance.

NIS2 is an EU directive raising cybersecurity requirements for "essential" and "important" entities across critical sectors, with governance and incident-reporting duties and national-law transposition. GDPR is the EU regulation governing protection of personal data, with strict obligations and significant fines. HIPAA is the US regime whose Security Rule protects electronic health information (ePHI).