FFIEC Cybersecurity Assessment Tool (CAT) CAT-D3-1: Preventative controls

What else in your programme already covers this

This control maps to 299 controls across 148 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ASD Strategies to Mitigate Cyber Security Incidents · 5 controls

ASD37-12 Antivirus software with heuristics (Very Good)
ASD37-16 Antivirus software with signatures (Limited)
ASD37-20 Multi-factor authentication (Essential)
ASD37-22 Network segmentation (Excellent)
ASD37-25 Software firewall - inbound (Very Good)

API 1164 · 4 controls

API1164-06 Access Control
API1164-07 Remote Access
API1164-09 Patch and Vulnerability Management
API1164-13 Business Continuity and Recovery

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 4 controls

AWWA-2.1 User Access Management
AWWA-2.4 Physical Access Controls
AWWA-3.1 Network Segmentation
AWWA-4.1 Malware Protection

IEC 62443 · 4 controls

IEC62443-07 Personnel risk assessment
IEC62443-08 Electronic access perimeter management
IEC62443-10 Revocation of access procedures
IEC62443-13 Network security monitoring

ISO 27019 · 4 controls

ISO27019-07 Personnel risk assessment
ISO27019-08 Electronic access perimeter management
ISO27019-10 Revocation of access procedures
ISO27019-13 Network security monitoring

ISO 27043 · 4 controls

ISO27043-11 Access control policy and enforcement
ISO27043-14 Privileged access management
ISO27043-15 Access review and recertification
ISO27043-27 Network security management

ISO/IEC 27011:2024 · 4 controls

27011-5.3 Segregation of duties
27011-6.3 Awareness and Training
27011-8.1 User Endpoint Devices
27011-8.2 Network security and segregation

ISO/SAE 21434 · 4 controls

ISO21434-12 User access management and provisioning
ISO21434-14 Privileged access management
ISO21434-15 Access review and recertification
ISO21434-27 Network security management

MARS-E · 4 controls

MARS-E-Access-Control-Identity-Authentication-NIST-800-63-Identity-Assurance-Levels-MFA-AC-IA-Families MARS-E Access Control + Identity + Authentication + NIST 800-63 + MFA + AC + IA Families
MARS-E-Cross-Program-Coordination-IRS-Pub-1075-FedRAMP-CMS-ARS-HHS-OIG-Joint-Audit-3PAO MARS-E Cross-Program + IRS Pub 1075 + FedRAMP + CMS ARS + HHS OIG + Joint Audit + 3PAO
MARS-E-Incident-Response-Breach-Notification-IR-Family-45-CFR-164-400-414-IRS-Pub-1075-Notification-CMS-IRT MARS-E Incident Response + Breach Notification + IR Family + 45 CFR 164.400-414 + IRS Pub 1075 + CMS IRT
MARS-E-Privacy-PII-PHI-Minimum-Necessary-HIPAA-Privacy-Rule-NIST-800-122-45-CFR-164-Subpart-E MARS-E Privacy + PII + PHI + Minimum Necessary + HIPAA Privacy Rule + NIST 800-122 + 45 CFR 164 Subpart E

NIST SP 1800-32 · 4 controls

NIST1800-32-07 Personnel risk assessment
NIST1800-32-08 Electronic access perimeter management
NIST1800-32-09 Interactive remote access security
NIST1800-32-13 Network security monitoring

BSI IT-Grundschutz · 3 controls

BSI-03 Multi-factor authentication requirements
BSI-04 Remote access controls
BSI-05 Wireless access restrictions

Ghana Cybersecurity Act · 3 controls

GhCSA-CII-Designation-Plan-Audit-Risk CII Designation, Registration, Cybersecurity Plan, Audit and Risk Assessment
GhCSA-Incident-Reporting-CERT-GH Cybersecurity Incident Reporting (24-Hour to CSA) and National CERT-GH Engagement
GhCSA-Scope-CSAGhana-Defs Scope, Cyber Security Authority (CSA Ghana) and Key Definitions

ISO 13485 · 3 controls

ISO13485-01 ePHI access controls and authorization
ISO13485-08 Information access management
ISO13485-17 Facility access controls

ISO 27799 · 3 controls

ISO27799-01 ePHI access controls and authorization
ISO27799-08 Information access management
ISO27799-17 Facility access controls

ISO/IEC 27010:2015 · 3 controls

27010-13.1 Communications Security
27010-9.1 Access Control to Shared Information
27010-9.2 Authentication of Sources

MDS2 (Medical Device) · 3 controls

MDS2-PHI-Data-Handling-DATA-Storage-STCF-Transmission-TXCF-TXIG-Encryption-FIPS MDS2 PHI Handling + DATA + STCF Storage + TXCF Transmission + TXIG Integrity + Encryption + FIPS
MDS2-Person-Node-Authentication-Authorization-Auto-Logoff-AUTH-PAUT-NAUT MDS2 Authentication + Authorization + Auto Logoff + PAUT + NAUT + AUTH + Identity Management
MDS2-Physical-Security-PLOK-Workstation-Disposal-Backup-DTBK-Disaster-Recovery MDS2 Physical Security + PLOK + Workstation + Disposal + Backup + DTBK + Disaster Recovery

MITRE ATT&CK · 3 controls

MITRE-ATTACK-Detection-Data-Sources-Analytics-Sigma-Splunk-KQL-Yara-Snort-SIEM-Hunt-Engineering MITRE ATT&CK Detection + Data Sources + Analytics + Sigma + Splunk + KQL + Yara + Snort + SIEM + Hunt
MITRE-ATTACK-Matrices-Enterprise-Mobile-ICS-Cloud-AWS-Azure-Google-Office-365-Container-Platform-Specific MITRE ATT&CK Matrices + Enterprise + Mobile + ICS + Cloud + AWS + Azure + Google + Office 365 + Container
MITRE-ATTACK-Techniques-Sub-Techniques-200-600-T1078-T1059-T1566-T1190-T1486-Procedures-Adversary-Behaviour MITRE ATT&CK Techniques + 200+ + Sub-Techniques + 600+ + T1078 + T1059 + T1566 + T1190 + T1486 + Procedures

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 3 controls

MD124-CTL-06 Network Security for Mobile
MD124-POL-01 Mobile Device Security Policy
MD124-TECH-05 VPN and Secure Communication

NIST SP 800-53 Rev 5 · 3 controls

NIST800-AC-2 Account management
NIST800-AC-20 Use of external systems
NIST800-AC-7 Unsuccessful logon attempts

NIST SP 800-66 · 3 controls

NISTSP66-2 Workforce Security, Information Access Management, and Awareness Training
NISTSP66-5 Physical Safeguards: Facility Access, Workstation Use and Security, Device and Media Controls
NISTSP66-6 Technical Safeguards: Access Control, Audit Controls, Integrity, Person Authentication

SLSA · 3 controls

SUPCHAIN-1 Build Integrity - Source, Build, Provenance
SUPCHAIN-2 Source Integrity - Branch Protection, Code Review, Two-Person Rule
SUPCHAIN-3 Dependency Verification and SBOM

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 2 controls

CPG-1.D Revoking Credentials for Departing Employees
CPG-8.A Network Segmentation

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 2 controls

DSO-2 Data Security
DSO-3 Data Access Management

FFIEC IT Examination Handbook · 2 controls

FFIEC-06 Network security and segmentation
FFIEC-07 Endpoint protection and detection

IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems · 2 controls

IACS-UR-E26-Protect-AccessControl-Authentication-IAM-Roles IACS UR E26 Protect Goal - Access Control + Identity + Authentication + Authorization + User Management
IACS-UR-E26-Protect-NetworkSegmentation-Zones-Conduits-Boundary IACS UR E26 Protect Goal - Network Segmentation + Zones + Conduits + Boundary Defence + Data Diodes

IEEE 1686 · 2 controls

IEEE1686-Section5.1-AccessControl-Accounts-Roles-Password-Session-Remote IEEE 1686 Section 5.1 - Electronic Access Account Management + Roles + Password + Failed Login + Session + Remote Access + Personnel
IEEE1686-Section5.2-5.3-AuditLog-Retention-Export-Monitoring IEEE 1686 Section 5.2 + 5.3 - Audit Trail Records + Retention + Export + Supervisory Monitoring and Control + Network Security Monitoring

MITRE D3FEND · 2 controls

MITRE-D3FEND-Harden-Tactic-Application-Credential-Message-Platform-Hardening-MFA-Encryption-Secure-Boot MITRE D3FEND Harden Tactic + Application + Credential + Message + Platform + MFA + Encryption + Secure Boot
MITRE-D3FEND-Isolate-Tactic-Execution-Network-Isolation-Sandboxing-Microsegmentation-DNS-Filtering MITRE D3FEND Isolate Tactic + Execution + Network Isolation + Sandboxing + Microsegmentation + DNS Filtering

NIS2 Directive Implementing Acts · 2 controls

NIS2I-6 Access Control, Asset Management, and Physical Security
NIS2I-7 Network Security, Logging, Monitoring, and Vulnerability Handling

NIST Privacy Framework · 2 controls

NISTPF-5 Protect-P Access Control (PR.AC-P)
NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

NIST SP 800-123 · 2 controls

NISTSP123-3 Authentication, Access Control, and Account Management
NISTSP123-6 Network Security and Server Communications

NIST SP 800-61 · 2 controls

NISTSP61-4 Detection and Analysis: Sources, Triage, Categorisation, Prioritisation
NISTSP61-5 Containment, Eradication, and Recovery

NIST SP 800-63-4 · 2 controls

NISTSP63R4-3 Authentication: Authenticator Types, MFA, Phishing-Resistance, and Syncable Authenticators
NISTSP63R4-5 Federation: Assertions, Trust Agreements, RP Validation, Pseudonymous Identifiers

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 2 controls

NISTSP82-4 OT Access Control, Identity, Authentication, and Remote Access
NISTSP82-5 OT Configuration Management, Patching, Vulnerability Management, and Malware Protection

NIST SP 800-88 · 2 controls

NISTSP88-1 Media Sanitization Policy, Roles, and Decision Framework
NISTSP88-8 Cloud-Resident Data, Hosted Storage, and Scope Boundaries

NIST SP 800-92 · 2 controls

NISTSP92-3 Log Infrastructure: Architecture, Centralisation, Transport Security, SIEM Governance
NISTSP92-4 Log Management: Time Synchronisation, Parsing, Storage, Integrity, Access Control

Nebraska Data Privacy Act · 2 controls

NDPA-1 Applicability, Scope, and Carve-Outs
NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal

Nigeria Data Protection Act 2023 (NDPA) · 2 controls

NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission
NG-NDPA-2 Lawful Basis, Consent, and Data Protection Principles

OWASP MASVS · 2 controls

OWASPMASVS-3 MASVS-AUTH: Authentication and Authorization
OWASPMASVS-4 MASVS-NETWORK: Network Communication

OWASP SAMM · 2 controls

OWASPSAMM-2 Design: Threat Assessment, Security Requirements, Security Architecture
OWASPSAMM-5 Operations: Incident Management, Environment Management, Operational Management

Oman National Cybersecurity Framework · 2 controls

OMANCS-3 Identity and Access Management, Authentication, Privileged Access
OMANCS-5 Network, Endpoint, System Development, and Configuration Security

PCI P2PE · 2 controls

PCI-P2PE-06 Network security and segmentation
PCI-P2PE-07 Endpoint protection and detection

PCI PIN Security · 2 controls

PCI-PIN-06 Network security and segmentation
PCI-PIN-07 Endpoint protection and detection

PCI SSF · 2 controls

PCI-SSF-06 Network security and segmentation
PCI-SSF-07 Endpoint protection and detection

PTES · 2 controls

PTESPHASE-2 Intelligence Gathering (OSINT)
PTESPHASE-4 Vulnerability Analysis

Protective Security Policy Framework (PSPF) Release 2024 · 2 controls

PSPF24-2 Information Security, Cybersecurity Maturity, Essential Eight
PSPF24-4 Physical Security

SIG (Shared Assessments) · 2 controls

SHAREASSESS-2 Access Control, Identity, Authentication
SHAREASSESS-4 Vulnerability Management, Patching, Application Security

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 2 controls

IM8-SEC.2 Access Control
IM8-SEC.3 Network Security

South Korea ISMS-P · 2 controls

ISMSP-AC-01 Access Control Policy
ISMSP-AC-04 Network Access Control

TISAX - Trusted Information Security Assessment Exchange · 2 controls

TISAX-TECH-03 Operations and Communications Security
TISAXASS-2 ISA Catalog Implementation

US Consumer Product Safety Commission (CPSC) - Connected Product Safety · 2 controls

CPSC-CS.1 Network Security for Connected Products
CPSC-CS.2 Authentication and Access Controls

APPI · 1 control

APPI-A26 Report of Leakage to the Commission and Notification to the Person

Annex 11 to EU GMP - Computerised Systems · 1 control

Clause 12 Security

Bahrain PDPL · 1 control

BH-PDPL-15 Access control for personal data

Canada ITSG-33 - IT Security Risk Management · 1 control

CA-ITSG33-SC-01 Security Control Catalogue

FDA 21 CFR Part 11 · 1 control

Part11.AccessAndAuth Access control + authority + device checks (21 CFR §11.10(d) + (f) + (g) + (h))

FISMA · 1 control

FISMA-CIRCIA-ZTA-EO14028 CIRCIA, Zero Trust Architecture, EO 14028 + 14110 + OMB Memoranda

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))

Family Educational Rights and Privacy Act (FERPA) · 1 control

FERPA-Safeguards-PTAC Data Security Safeguards for PII in Education Records (PTAC Best Practices, SPPO Guidance)

FedRAMP Rev 5 · 1 control

FedRAMP-Boundary Authorization Boundary, SSP, SAR, POA&M documentation

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

UAE-PDPL-Art.6_7 Sensitive personal data and children's data (UAE PDPL Articles 6-7)

GLBA · 1 control

GLBA-Subordinate-Rules-Operationalisation GLBA Operationalisation through FTC Safeguards Rule, Privacy Rule, SEC Reg S-P and Banking-Agency Guidelines

HITECH Act · 1 control

HITECH-Coord-HIPAA-Privacy-Security-Cures-ONC HITECH Coordination with HIPAA Privacy Rule + HIPAA Security Rule (Verified Separately) + 21st Century Cures Act + ONC

HKMA Cyber Resilience Assessment Framework (C-RAF) · 1 control

HKMA-CRAF-Domain3-4-Protection-Detection HKMA C-RAF Domain 3 (Protection) + Domain 4 (Detection) - Access, Data, Infrastructure, Application, Monitoring, Testing, Threat Intel

HKMA SPM · 1 control

HKMA-SPM-TM-Technology-TM-G-1-CRAF-Coord HKMA SPM Technology Management Modules (TM-G-1 to TM-G-4, TM-E-1) + Coordination with C-RAF

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

IAEA-NSS17-AccessControl-OT-IT-Authentication-Authorization IAEA NSS-17 - Access Control + Authentication + Authorization + IAM + Privileged Access for OT and IT

IATA Operational Safety Audit (IOSA) Standards Manual · 1 control

IATA-IOSA-Section8-SEC-SecurityManagement-AVSEC IATA IOSA Section 8 - SEC Security Management + Aviation Security Programme (AVSEC) + ICAO Annex 17 Alignment

ICAO Annex 17 - Aviation Security (AVSEC) · 1 control

ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18)

IEC 62351 - Power Systems Communication Security · 1 control

62351-8 Role-based access control (RBAC)

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2) · 1 control

IMO-MSC-FAL-Protect-AccessControl-NetworkSegmentation-MalwareDefence-Patch-Awareness-DataSecurity IMO MSC-FAL Protect Function - Access Control + Network Segmentation + Malware Defence + Patch Management + Awareness Training + Data Security + Crew BYOD + Removable Media

ISMAP (Japan) · 1 control

ISMAP-CloudInfrastructure-NetworkSegmentation-Container-Serverless-WorkloadProtection-Hardening-ConfigManagement ISMAP Cloud Infrastructure - VPC Network Segmentation + Container/Serverless Security + Cloud Workload Protection (CWPP) + Image/Template Hardening + CIS Benchmarks + Configuration Management + IaC

ISO 20000-1 · 1 control

ISO20000-15 Access management for services

ISO 27017 · 1 control

ISO27017-16 Virtual network segmentation

ISO 27018 · 1 control

ISO27018-16 Virtual network segmentation

ISO 28001:2007 Supply Chain Security Management · 1 control

ISO28001-PS-01 Facility Security

ITIL 4 · 1 control

ITIL4-15 Access management for services

ITU-T X.805 - Security Architecture for End-to-End Communications · 1 control

X805-Dim1-Access-Control-RBAC-Authorization-Resources-Network-Elements-Services-Applications ITU-T X.805 Security Dimension 1 - Access Control + Role-Based Access Control (RBAC) + Authorization + Resources + Network Elements + Services + Applications + Access Limitations + Authorized Personnel + Discretionary + Mandatory Access Control

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) · 1 control

ICELAND-Act90-Chap4-Security-BreachNotification-DPIA-Personuvernd-72hr Iceland Act 90/2018 - Chapter IV Security of Processing + Breach Notification + DPIA (Articles 27-29)

India CERT-In Cyber Security Directions 2022 · 1 control

CERTIN-DC-VPS-VPN-CloudSP-CustomerKYC-SubscriberRecords-5YearRetention-Dir8to10 CERT-In Directions 8-10 Service Provider Obligations - Data Centre + Virtual Private Server + VPN Service Provider Customer KYC + Subscriber Records + 5-Year Retention After Cancellation

India DPDP Act · 1 control

DPDP-CrossBorder-Transfer-Breach-Notification-Sec16-Sec17-DPBI-72Hour-IT-Act-Coord DPDP Act Sections 16-17 + Cross-Border Personal Data Transfer + Negative List Approach + Personal Data Breach Notification to DPBI 72 Hours + Cooperation with Adjudication + Coord with CERT-In + IT Act 43A Repeal

Indiana Consumer Data Protection Act · 1 control

INCDPA-Security-ReasonablePractices-Breach-Notification-Records-Encryption-Pseudonymisation Indiana CDPA Security + Reasonable Practices + Breach Notification + Indiana Breach Notification Law (IC 24-4.9) + Records + Encryption + Pseudonymisation + De-Identification

Indonesia PDP Law · 1 control

IDPdp-LawfulBasis-Notice-Consent-PurposeLimitation-DataMinimisation-Art16to19-ExplicitConsent Indonesia PDP Articles 16-19 + Lawful Basis + Notice + Explicit Consent + Purpose Limitation + Data Minimisation + 6 Lawful Bases + Withdrawal + Transparency

Iowa Consumer Data Protection Act · 1 control

ICDPA-Controller-PrivacyNotice-PurposeLimitation-DataMinimisation-Sale-Disclosure-Transparency-LawfulBasis Iowa CDPA Controller Obligations - Privacy Notice + Purpose Limitation + Data Minimisation + Sale Disclosure Statement + Targeted Advertising Disclosure + Privacy by Design + Lawful Processing

Jamaica Data Protection Act 2020 · 1 control

JM-DPA2020-Complaints-Enforcement-Sec45-50-Investigation-Hearing-Determination-Appeal-Tribunal Jamaica DPA 2020 Complaints + Enforcement + Sections 45-50 + Complaint Procedure + Investigation + Hearing + Determination + Compliance Orders + Administrative Penalties + Data Protection Tribunal + High Court Appeals

Kentucky Consumer Data Protection Act · 1 control

KY-CDPA-Attorney-General-AG-Enforcement-Sole-30-Day-Cure-Period-7500-Civil-Penalty-Per-Violation Kentucky CDPA Attorney General Enforcement + Sole Authority + 30-Day Cure Period + USD 7,500 Civil Penalty Per Violation + No Private Right of Action + Injunctive Relief + Attorneys' Fees + Section 9 Enforcement + Children's Data + Sensitive Data Heightened

LGPD · 1 control

LGPD-BR-Security-Article-46-48-Breach-Notification-ANPD-Reasonable-Time-Incident-Response-CSIRT Brazil LGPD Security + Article 46-48 + Breach Notification + ANPD + Incident Response

Laos Law on Prevention and Combating Cybercrime (2015) · 1 control

LAOS-CC-Network-Security-Information-Security-Obligations-Article-21-Service-Provider-Duties Laos Cybercrime Network Security + Information Security Obligations + Article 21 + Service Provider Duties

MARS-E - Minimum Acceptable Risk Standards for Exchanges · 1 control

MARSE-SC-02 Federal Tax Information Protection

MTCS (Singapore) · 1 control

MTCS-Incident-Business-Continuity-CSC-Data-Protection-72-Hour-Notification-BCP-DR-PDPA MTCS Incident + Business Continuity + CSC Data Protection + 72-Hour Notification + BCP + DR + PDPA

Malaysia PDPA 2010 · 1 control

MY-PDPA-Cross-Border-Transfer-Section-129-Whitelist-Abolition-2024-Adequacy-SCC-BCR-Processor-Direct-Marketing Malaysia PDPA Cross-Border + Section 129 + Whitelist Abolition 2024 + Adequacy + SCC + BCR + Processor + Marketing

Maryland Online Data Privacy Act of 2024 · 1 control

MD-MODPA-Sensitive-Data-Health-Biometric-Section-14-4607-Reasonably-Necessary-Proportionate-Data-Minimization Maryland MODPA Data Minimization + Sensitive + Health + Biometric + Section 14-4607 + Reasonably Necessary + Proportionate

Mauritius DPA · 1 control

MU-DPA-Governance-DPO-Designation-Section-25-DPO-ROPA-DPIA-Codes-Section-38-Commissioner-Registration Mauritius DPA Governance + DPO + ROPA + DPIA + Codes Section 38 + Commissioner Registration

Mexico LFPDPPP · 1 control

MX-LFPDPPP-Governance-Officer-Reglamento-47-50-Security-Manual-57-Risk-Assessment-61-Self-Regulation-Parameters-2014 Mexico LFPDPPP Governance + Officer + Reglamento 47 + Security Manual 50 + Risk Assessment 57 + Self-Regulation Parameters 2014

Minnesota Consumer Data Privacy Act · 1 control

MN-CDPA-Chief-Privacy-Officer-Section-325O-06-MN-UNIQUE-Designation-Privacy-Programme-Training Minnesota CDPA Chief Privacy Officer + Section 325O.06 + MINNESOTA-UNIQUE Designation + Privacy Programme + Training

Monetary Authority of Singapore Technology Risk Management Guidelines · 1 control

MAS-TRM-Project-SDLC-Service-Management-Chapters-4-5-6-IT-Project-Software-Lifecycle-Change-ITIL MAS TRM Project + SDLC + Service Management + Chapters 4-6 + IT Project + Software Lifecycle + ITIL

Montana Consumer Data Privacy Act · 1 control

MT-CDPA-Sensitive-Data-MCA-30-14-2802-Opt-In-Children-13-Parental-Consent-Minors-13-16-Opt-In Montana CDPA Sensitive Data + MCA 30-14-2802 + Affirmative Opt-In + Children Under 13 Parental + Minors 13-16 Opt-In

Myanmar Cybersecurity Law (2023) · 1 control

MMCL-5 Content Moderation, Removal Requests, and Lawful Access

NAIC Insurance Data Security Model Law (MDL-668) · 1 control

NAIC-2 Information Security Program (ISP) - Section 4

NERC CIP · 1 control

NERCCIP-5 System Security Management + Configuration Change Management and Vulnerability Assessments (CIP-007 + CIP-010)

NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment) · 1 control

NISTSP115-8 Operational Considerations - Tools, Reporting Templates, ISMS Integration, Annex Material

NIST SP 800-122 · 1 control

NISTSP122-5 PII Security Controls - Encryption, Access Control, Storage, Audit

NIST SP 800-137 · 1 control

NISTSP137-6 Malware, Identity Access, and Network Boundary Monitoring

NIST SP 800-144 · 1 control

NISTSP144-2 Cloud Architecture, Service Selection, and Tenant Isolation

NIST SP 800-145 · 1 control

NISTSP145-6 Deployment Model Classification (Private, Community, Public, Hybrid)

NIST SP 800-146 · 1 control

NISTSP146-4 IaaS Operational Recommendations and Workload Hardening

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 1 control

3.10 Encrypt Sensitive Data in Transit

NIST SP 800-190 · 1 control

NIST190-16 Virtual network segmentation

New Hampshire Data Privacy Act · 1 control

NHPA-7 Data Protection Assessments and Processor Contracts

New Jersey Data Privacy Act · 1 control

NJDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal

New Zealand Information Security Manual (NZISM) · 1 control

NZISM-5 Network Security, System Hardening, and Application Security

Nigeria Data Protection Regulation (NDPR) · 1 control

NGNDPR-5 Security of Personal Data, Breach Notification, and DPIA under NDPR Section 2.6-Security

O-RAN WG11 Security Specification · 1 control

ORANWG11-2 O-RAN Interface Security: E2, A1, O1, O2, Open Fronthaul

OSFI B-13 · 1 control

OSFIB13-3 Cyber Security: Identification, Protection, Detection, Response, Recovery

OWASP DevSecOps Maturity Model (DSOMM) · 1 control

DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management

OWASP Top 10:2025 · 1 control

OWASPTOP10-1 A01:2025 Broken Access Control

Open Banking Security · 1 control

OPENBANK-3 Mutual TLS, Token Binding, Request Signing (JWS), Key Management

OpenSSF Scorecard · 1 control

OSSFSC-3 Build, CI/CD Security, Workflow Permissions, Dangerous Patterns

Oregon Consumer Privacy Act · 1 control

OREGONCPA-5 Data Protection Assessments, Privacy by Design, Security Practices

PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments · 1 control

PASONE-4 Technical Security: CDE Configuration, BIM Tools, Encryption, Aggregation, Mobile Working

PDPA Singapore · 1 control

PDPASG-5 Protection, Accuracy, and Security of Personal Data

PDPA Thailand · 1 control

PDPATH-5 Security Measures and Data Protection

POPIA · 1 control

POPIASA-5 Security Safeguards, Encryption, Access Control, Operator Obligations

PSD2 SCA · 1 control

PSDTWO-1 Strong Customer Authentication (SCA) Core Requirements

Personal Data Act (personopplysningsloven) · 1 control

NORWAY-5 Security of Processing, Encryption, Pseudonymization, Access Control

Peru DPL · 1 control

PERU-7 DPO, Records, Retention, Marketing, Training

Privacy Act 2020 · 1 control

NZPRV-2 IPP 5 Storage and Security of Personal Information

Qatar DPL · 1 control

QATAR-5 Security of Processing

SOC 2 · 1 control

SOC2-CC6.3 Role-based access and least privilege are enforced

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 1 control

SOC-CY-S1 Logical and Physical Access Controls

Saudi Arabia PDPL · 1 control

SA-PDPL-15 Access control for personal data

Sigstore - Software Artifact Signing and Verification · 1 control

SIGSTORE-2 Transparency Log (Rekor) and Verification

South Korea PIPA · 1 control

PIPA-Cross-Border-Transfer-Articles-28-8-28-9-Adequacy-Standard-Contract-Certification-EU Korea PIPA Cross-Border Transfer + Articles 28-8 + 28-9 + Adequacy + EU 2021

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 1 control

CH-FADP-15 Cooperation with the FDPIC

TSA Pipeline Cybersecurity Directives · 1 control

TSAPIPE-2 OT/IT Network Segmentation and Access Control

Taiwan PDPA · 1 control

TAIWAN-3 Data Subject Rights

Texas Data Privacy Act · 1 control

TEXASTDPSA-2 Consumer Rights

Turkey KVKK · 1 control

TURKEYKVKK-2 Information Notice and Data Subject Rights

UK Gambling Commission - Cyber Resilience Requirements · 1 control

UKGAMBLE-4 Resilience and Incident Response

UK Security and Emergency Measures Direction (SEMD) - Water Industry · 1 control

SEMD-PS-2 Site Security Measures

UK Telecommunications (Security) Act 2021 · 1 control

UK-TSA-NET-02 Access Control and Authentication

US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements · 1 control

USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR)

US ITAR and EAR - Export Control and Data Security · 1 control

US-ITAR-EAR-DS-03 Access Controls

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements · 1 control

CYB-3 Device Security Measures

Uruguay DPL · 1 control

URUGUAY-3 Sensitive Data, Health Data, Children

Vietnam PDPD · 1 control

VIETNAMPDP-2 Consent and Notice

Virginia CDPA · 1 control

VIRGINIAVCDPA-3 Sensitive Data Consent and Children

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.