OWASP DevSecOps Maturity Model (DSOMM)
Culture and Organization

OWASP DevSecOps Maturity Model (DSOMM) DSOMM-1: Culture, Organization, Education, and Governance

Per OWASP DevSecOps Maturity Model (DSOMM) Culture and Organization dimension: establish organisational structures + governance + education + collaboration + that embed security into DevOps culture. Requirements include (a) maintain documented security governance structures with defined roles + responsibilities + accountability + (b) operate a security champions programme embedding security advocates within product + engineering teams + (c) implement cross-team collaboration including security + development + operations + product + (d) deliver security training programmes including role-based training + secure coding + awareness + tooling proficiency + (e) maintain security policy + enforcement including exception management + (f) measure cultural maturity via metrics including training completion + champion coverage + security advocate engagement.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 351 controls across 155 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ASD Strategies to Mitigate Cyber Security Incidents · 5 controls

  • ASD37-18 Restrict administrative privileges (Essential)
  • ASD37-20 Multi-factor authentication (Essential)
  • ASD37-31 Hunt to discover incidents (Very Good)
  • ASD37-33 Capture network traffic (Limited)
  • ASD37-37 Personnel management (Very Good)

BSI IT-Grundschutz · 5 controls

  • BSI-02 Access enforcement and least privilege
  • BSI-14 Vulnerability scanning and management
  • BSI-18 Incident response planning and testing
  • BSI-20 Incident reporting and notification
  • BSI-21 Forensic analysis capabilities

ISO/IEC 27011:2024 · 5 controls

  • 27011-1 Scope
  • 27011-3 Terms and definitions
  • 27011-6.3 Awareness and Training
  • 27011-8.1 User Endpoint Devices
  • 27011-8.5 Vulnerability and malware management

ISO/IEC 30111:2019 · 5 controls

  • 30111-1 Scope
  • 30111-3 Terms and definitions
  • 30111-5.1 Organizational policy
  • 30111-5.2 Vulnerability handling team
  • 30111-8.1 Post-release monitoring

MTCS (Singapore) · 5 controls

  • MTCS-Acquisition-Development-Maintenance-Supplier-Vulnerability-DevSecOps-SBOM-SDLC-SCA-API-Container MTCS Acquisition + Development + Maintenance + Supplier + Vulnerability + DevSecOps + SBOM + SDLC + SCA
  • MTCS-Asset-IAM-Cryptography-Multi-Tier-Asset-Inventory-RBAC-MFA-PAM-FIPS-HSM-Quantum-Safe MTCS Asset Mgmt + IAM + Cryptography + Asset Inventory + RBAC + MFA + PAM + FIPS + HSM + Quantum-Safe
  • MTCS-Governance-ISMS-Risk-HR-Lifecycle-Compliance-Cloud-Strategy-Roles-Responsibilities MTCS Governance + ISMS + Risk Management + HR Security + Cloud Service Lifecycle + Compliance + Roles
  • MTCS-Incident-Business-Continuity-CSC-Data-Protection-72-Hour-Notification-BCP-DR-PDPA MTCS Incident + Business Continuity + CSC Data Protection + 72-Hour Notification + BCP + DR + PDPA
  • MTCS-Logging-Monitoring-Compliance-Audit-SLA-Configuration-SIEM-SOAR-Cloud-Monitoring-CSPM MTCS Logging + Monitoring + Compliance + Audit + SLA + Configuration + SIEM + SOAR + CSPM

Annex 11 to EU GMP - Computerised Systems · 4 controls

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 4 controls

  • CPG-1.C Unique Credentials
  • CPG-4.C Basic Cybersecurity Training
  • CPG-5.A Vulnerability Disclosure Program
  • CPG-6.B Supply Chain Incident Reporting

FFIEC Cybersecurity Assessment Tool (CAT) · 4 controls

  • CAT-D1-4 Training and culture
  • CAT-D3-3 Corrective controls
  • CAT-D5-1 Incident planning and strategy
  • CAT-IRP-4 Organizational characteristics

Ghana Cybersecurity Act · 4 controls

  • GhCSA-CII-Designation-Plan-Audit-Risk CII Designation, Registration, Cybersecurity Plan, Audit and Risk Assessment
  • GhCSA-Cybercrime-Lawful-Access-Preservation Cybercrime Offences, Lawful Access and Electronic Evidence Preservation
  • GhCSA-Implementation-Roadmap Implementation Roadmap - Organizational Roles, Tooling and Metrics
  • GhCSA-Incident-Reporting-CERT-GH Cybersecurity Incident Reporting (24-Hour to CSA) and National CERT-GH Engagement

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 4 controls

ISO/IEC 29147:2018 · 4 controls

  • 29147-3 Terms and definitions
  • 29147-5.6 Advisory Content and Quality
  • 29147-7.8 Remediation information
  • 29147-9.2 Contact mechanisms and scope

Nebraska Data Privacy Act · 4 controls

  • NDPA-1 Applicability, Scope, and Carve-Outs
  • NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal
  • NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation
  • NDPA-6 Reasonable Security Practices and Incident Response

Nigeria Data Protection Act 2023 (NDPA) · 4 controls

  • NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission
  • NG-NDPA-2 Lawful Basis, Consent, and Data Protection Principles
  • NG-NDPA-5 Security of Processing, Breach Notification, and DPIA
  • NG-NDPA-6 Data Protection Officer, DPCO, and Processor Agreements

O-RAN WG11 Security Specification · 4 controls

  • ORANWG11-1 O-RAN Threat Model, Risk Management, and Security Architecture
  • ORANWG11-2 O-RAN Interface Security: E2, A1, O1, O2, Open Fronthaul
  • ORANWG11-3 Cryptography, TLS, SSH, IPsec, and PKI Lifecycle Management
  • ORANWG11-6 Security Test Specifications, Certification, and Conformance

OSFI B-13 · 4 controls

  • OSFIB13-1 Governance, Risk Management, and Three Lines of Defense
  • OSFIB13-3 Cyber Security: Identification, Protection, Detection, Response, Recovery
  • OSFIB13-7 Incident Reporting to OSFI and Regulatory Coordination
  • OSFIB13-8 Metrics, Monitoring, Continuous Improvement, Maturity

API 1164 · 3 controls

  • API1164-17 Wireless and Field Communications
  • API1164-18 Field Device Security
  • API1164-19 Safety Instrumented Systems Interface

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 3 controls

  • AWWA-1.1 Security Policy and Governance
  • AWWA-1.3 Security Awareness and Training
  • AWWA-2.1 User Access Management

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 3 controls

  • DA-1 Enterprise Data Architecture
  • DIQ-2 Data Quality Management
  • DSO-3 Data Access Management

FISMA · 3 controls

  • FISMA-3554-Agency-Responsibilities Federal Agency Responsibilities (44 USC 3554) - CIO + CISO + Program + Reporting
  • FISMA-CIRCIA-ZTA-EO14028 CIRCIA, Zero Trust Architecture, EO 14028 + 14110 + OMB Memoranda
  • FISMA-NIST-800-53-RMF-800-171-FIPS Operationalisation via NIST 800-53 + 800-37 RMF + 800-171 + FIPS 199 + FIPS 200

FTC GLBA Safeguards Rule (16 CFR Part 314) · 3 controls

  • FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j))
  • FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2)
  • FTC-Safeguards-ServiceProvider-Evaluation Service Provider Oversight + Program Evaluation + Personnel Training (16 CFR 314.4(d-g))

FedRAMP Rev 5 · 3 controls

  • FedRAMP-Boundary Authorization Boundary, SSP, SAR, POA&M documentation
  • FedRAMP-ConMon Continuous Monitoring (ConMon) and Significant Change Requests
  • FedRAMP-IncidentReporting FedRAMP incident reporting to PMO and US-CERT

GLBA · 3 controls

  • GLBA-Implementation-Roadmap-Examination GLBA Implementation Roadmap, Examination Readiness, Roles and Tooling
  • GLBA-Sec6801-PolicyDuty-SafeguardingStandard GLBA Section 6801 - Privacy Obligation Policy and Safeguarding Standard
  • GLBA-Status-FTC-CFPB-SEC-NAIC-Enforcement GLBA Status, Enforcement Activity, FTC + CFPB + SEC + NAIC Recent Actions

ISMAP (Japan) · 3 controls

ISO/IEC 27004:2016 · 3 controls

  • 27004-3 Terms and definitions
  • 27004-A.2 Patching and Vulnerability Measures
  • 27004-B.1 Example measurement definitions

ISO/IEC 27400:2022 · 3 controls

  • 27400-3 Terms and definitions
  • 27400-6.1 Secure Device Design
  • 27400-6.5 Security monitoring and incident response

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 3 controls

  • 27557-1 Scope
  • 27557-3 Terms and definitions
  • 27557-6.2 Scope, context, and criteria for privacy

ISO/IEC 29100:2024 · 3 controls

  • 29100-1 Scope
  • 29100-3 Terms and definitions
  • 29100-4.1 Actors and roles

ITAR - International Traffic in Arms Regulations · 3 controls

  • ITAR-Part123-125-ExportLicensing-DSP-5-DSP-73-DSP-61-MLA-TAA-Classified-Information-Routed ITAR Parts 123-125 Export Licensing - DSP-5 Permanent Export + DSP-73 Temporary Export + DSP-61 Temporary Import + DSP-83 + Manufacturing License Agreements (MLA) + Technical Assistance Agreements (TAA) + Classified Information + Routed Export Transactions
  • ITAR-Scope-AECA-22USC2778-22CFR120-130-DDTC-USML-21Categories-DefenseArticle-Service-TechnicalData ITAR Scope + Arms Export Control Act (22 USC 2778) + 22 CFR Parts 120-130 + Directorate of Defense Trade Controls (DDTC) + United States Munitions List (USML) 21 Categories + Defense Article/Service/Technical Data Definitions
  • ITAR-TechnicalData-DefenseServices-DeemedExport-ForeignPerson-Access-USPersons-FOC-AUKUS-Exemptions ITAR Technical Data + Defense Services + Deemed Export Rule + Foreign Person Access + US Persons Only + FOCI Foreign Ownership Control Influence + AUKUS Pillar 2 Exemptions + DD-2345 MCTL

MITRE ATT&CK · 3 controls

NIST Privacy Framework · 3 controls

  • NISTPF-3 Control-P - Privacy Controls, Data Management, and Disassociated Processing
  • NISTPF-5 Protect-P Access Control (PR.AC-P)
  • NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment) · 3 controls

  • NISTSP115-1 Scope, Methodology, and Assessment Planning
  • NISTSP115-3 Target Identification and Analysis - Network Discovery, Port and Service ID, Vuln Scanning
  • NISTSP115-8 Operational Considerations - Tools, Reporting Templates, ISMS Integration, Annex Material

NIST SP 800-123 · 3 controls

  • NISTSP123-3 Authentication, Access Control, and Account Management
  • NISTSP123-5 Server Operations - Patching, Malware, Logging, Backup
  • NISTSP123-8 Governance, Policies, and ISMS Integration

NIST SP 800-137 · 3 controls

  • NISTSP137-1 ISCM Strategy, Governance, and Volatility Assessment
  • NISTSP137-5 Vulnerability + Patch + Configuration Status Monitoring
  • NISTSP137-6 Malware, Identity Access, and Network Boundary Monitoring

NIST SP 800-144 · 3 controls

  • NISTSP144-1 Cloud Governance, Risk Assessment, and Provider Trust Evaluation
  • NISTSP144-7 Cloud Workload Protection, Containers, Serverless, and Configuration
  • NISTSP144-8 Monitoring, Incident Response, Exit Strategy, and Compliance

NIST SP 800-63-4 · 3 controls

  • NISTSP63R4-1 Digital Identity Risk Management and IAL/AAL/FAL Assurance Level Selection
  • NISTSP63R4-3 Authentication: Authenticator Types, MFA, Phishing-Resistance, and Syncable Authenticators
  • NISTSP63R4-8 Operational Audit, Session Management, Recovery, and Cross-cutting Controls

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 3 controls

  • NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration
  • NISTSP82-4 OT Access Control, Identity, Authentication, and Remote Access
  • NISTSP82-7 OT Incident Response, Forensics, Recovery, and Continuity

NIST SP 800-92 · 3 controls

  • NISTSP92-1 Log Management Programme, Policy, Roles, and Operational Runbooks
  • NISTSP92-4 Log Management: Time Synchronisation, Parsing, Storage, Integrity, Access Control
  • NISTSP92-5 Log Analysis: Correlation, Baselining, Anomaly Detection, Alerting, Manual Review

OWASP Top 10:2025 · 3 controls

Oman National Cybersecurity Framework · 3 controls

  • OMANCS-3 Identity and Access Management, Authentication, Privileged Access
  • OMANCS-6 Security Monitoring, Detection, Incident Response, and OmanCERT Notification
  • OMANCS-8 Third-Party + Supply Chain Risk, Awareness Training, Physical Security, Compliance Audit

Open Banking Security · 3 controls

  • OPENBANK-2 Strong Customer Authentication (SCA), Consent Lifecycle, and Customer UX
  • OPENBANK-7 Logging, Monitoring, Regulatory Reporting, SLA, Availability
  • OPENBANK-8 Incident Detection, Response, Customer Notification, Post-Incident Review, BCM

OpenSSF Scorecard · 3 controls

  • OSSFSC-1 Branch Protection, Code Review, and Repository Governance
  • OSSFSC-2 Dependency Management, Pinning, Updates, Vulnerability Tracking
  • OSSFSC-3 Build, CI/CD Security, Workflow Permissions, Dangerous Patterns

Pakistan Personal Data Protection Bill 2023 · 3 controls

  • PAKPDPB-5 Security of Processing and Personal Data Breach Notification
  • PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO
  • PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training

South Korea PIPA · 3 controls

  • PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33
  • PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37
  • PIPA-Sensitive-Information-Unique-ID-Resident-Registration-Numbers-CCTV-Articles-23-24-25 Korea PIPA Sensitive Information + Unique ID + RRN + CCTV + Articles 23-25

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 3 controls

  • D.1 Incident Response Planning
  • D.2 Incident Reporting
  • UKDEFSTD-1 Cyber Defence Cyber Risk Profile (CRP)

21 CFR Part 58 - Good Laboratory Practice (GLP) · 2 controls

  • 58.1 Scope
  • 58.3 Definitions

APPI · 2 controls

  • APPI-A41 Preparation and Handling of Pseudonymized Personal Information
  • APPI-A43 Preparation of Anonymized Personal Information

APRA CPS 234 · 2 controls

  • CPS234-21 Implementation of Information Security Controls
  • CPS234-25 Internal Audit Review of Information Security Controls

ASIS SPC.1-2009 - Organizational Resilience Standard · 2 controls

  • 4.4.1 Resources, Roles, Responsibility, and Authority
  • 4.4.7 Emergency and Incident Response

Albania Law No. 124/2024 on Personal Data Protection · 2 controls

  • AL-DPA-1 Scope and Definitions
  • AL-DPA-3 Lawful Basis for Processing

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 2 controls

  • AT-DSG-2 Section 2 - Scope and application
  • AT-DSG-8 Section 22 - Functions and powers of the DPA

Bahrain PDPL · 2 controls

Barbados Data Protection Act 2019 · 2 controls

  • BB-DPA-2 Section 2 - Interpretation
  • BB-DPA-20 Sections 50-60 - Registration and Responsibilities

FDA 21 CFR Part 11 · 2 controls

  • Part11.10 Controls for closed systems (21 CFR §11.10)
  • Part11.AccessAndAuth Access control + authority + device checks (21 CFR §11.10(d) + (f) + (g) + (h))

FIRST CSIRT Services Framework and Standards · 2 controls

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 2 controls

  • UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10)
  • UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21)

GAMP 5 - Good Automated Manufacturing Practice · 2 controls

  • GAMP5-Lifecycle-VModel-URS-FS-DS-IQOQPQ V-Model Lifecycle - URS + FS + DS + IQ + OQ + PQ + Traceability
  • GAMP5-Risk-CriticalThinking Risk-Based Approach, Critical Thinking and 5 Key Concepts

HITECH Act · 2 controls

  • HITECH-SubtitleD-Breach-Notification-BA-Direct-Liability HITECH Subtitle D - Breach Notification Rule (45 CFR Part 164 Subpart D), Business Associate Direct Liability, Subcontractors
  • HITECH-SubtitleD-StrengthIndividualRights HITECH Subtitle D - Strengthened Individual Rights (Electronic Access, Accounting of Disclosures, Restrictions, Sale Prohibition)

HKMA SPM · 2 controls

  • HKMA-SPM-CG-IC-AC-Governance-Control-Audit HKMA SPM Corporate Governance (CG-1/2/3/5/6), Internal Control (IC-1/5), Auditing (AC-G)
  • HKMA-SPM-TM-Technology-TM-G-1-CRAF-Coord HKMA SPM Technology Management Modules (TM-G-1 to TM-G-4, TM-E-1) + Coordination with C-RAF

IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems · 2 controls

  • IACS-UR-E26-Respond-Recover-IncidentResponse-Recovery-Backup-Lessons IACS UR E26 Respond + Recover Goals - Incident Response + Communication + Recovery + Backup + Lessons Learned
  • IACS-UR-E27-Logging-Forensics-EventCapture IACS UR E27 - Equipment Logging + Forensic Readiness + Event Capture + Tamper Detection

IATA Operational Safety Audit (IOSA) Standards Manual · 2 controls

  • IATA-IOSA-Section1-ORG-Organization-ManagementSystem-SMS IATA IOSA Section 1 - ORG Organization and Management System + Safety Management System (SMS) + Safety Policy + Hazard ID + Quality
  • IATA-IOSA-Section8-SEC-SecurityManagement-AVSEC IATA IOSA Section 8 - SEC Security Management + Aviation Security Programme (AVSEC) + ICAO Annex 17 Alignment

IATF 16949:2016 - Quality Management System for Automotive Production · 2 controls

  • IATF16949-Clause10-Improvement-Nonconformity-CorrectiveAction-Problem-ErrorProof IATF 16949 Clause 10 - Improvement + Nonconformity + Corrective Action + Problem Solving + Error Proofing + Continual Improvement
  • IATF16949-Clause9-Performance-Monitoring-InternalAudit-ManagementReview IATF 16949 Clause 9 - Performance Evaluation + Monitoring + Internal Audit + Manufacturing Process Audit + Management Review

ICH Q10 - Pharmaceutical Quality System · 2 controls

IEC 60601-1 - Medical Electrical Equipment Safety · 2 controls

  • 60601-1.3 Terminology and definitions
  • 60601-1.4.1 General requirements

IEC 62351 - Power Systems Communication Security · 2 controls

  • 62351-2 Glossary of terms
  • 62351-8 Role-based access control (RBAC)

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.4) · 2 controls

  • IMO-MSC-FAL-Identify-AssetInventory-ThreatsVulnerabilities-CyberRiskAssessment-RolesResponsibilities IMO MSC-FAL Identify Function - OT/IT Asset Inventory + Threats + Vulnerabilities + Cyber Risk Assessment + Roles and Responsibilities + Crew + CSO + DPA
  • IMO-MSC-FAL-Protect-AccessControl-NetworkSegmentation-MalwareDefence-Patch-Awareness-DataSecurity IMO MSC-FAL Protect Function - Access Control + Network Segmentation + Malware Defence + Patch Management + Awareness Training + Data Security + Crew BYOD + Removable Media

ISO/IEC 27014:2020 · 2 controls

  • 27014-1 Scope
  • 27014-3 Terms and definitions

ISO/IEC 29134:2023 · 2 controls

  • 29134-3 Terms and definitions
  • 29134-9.2 Report findings and recommendations

Indonesia PDP Law · 2 controls

Iowa Consumer Data Protection Act · 2 controls

Israel Protection of Privacy Law (5741-1981) · 2 controls

  • IsraelPPL-Database-Registration-Definition-Document-Security-Level-Classification-Sec7-8-PPA-Registry Israel POPL Database Registration + Section 7 Database Definitions + Section 8 Registration Requirement + Database Definition Document + Security Level Classification + PPA Public Registry + Amendment 13 Threshold Changes
  • IsraelPPL-Scope-5741-1981-Knesset-Amendment13-March2024-BasicLaw-Dignity-Sec1-Right-Privacy Israel Protection of Privacy Law 5741-1981 Scope + Knesset + Amendment No. 13 March 2024 + Basic Law Human Dignity and Liberty + Section 1 Right to Privacy + Constitutional Status + Chapter 1 Infringement of Privacy

Jamaica Data Protection Act 2020 · 2 controls

Japan FSA Cybersecurity Guidelines for Financial Institutions · 2 controls

  • JP-FSA-CYB-Cybersecurity-Exercises-Drills-Annual-Tabletop-Industry-Wide-Exercise-Delta-Wall-FSA-Coordinated-Sector Japan FSA Cybersecurity Exercises + Drills + Annual Tabletop + Industry-Wide Exercise + Delta Wall + FSA Coordinated Sector-Wide + FISC Drills + Cross-Sector Crisis Coordination + International Exercises + Cyber Range
  • JP-FSA-CYB-Incident-Response-Playbooks-Containment-Eradication-Recovery-Post-Mortem-Tabletop-CSIRT Japan FSA Cybersecurity Incident Response + Playbooks + Containment + Eradication + Recovery + Post-Mortem + Tabletop Exercises + CSIRT + FSA Notification + Customer Communication + Forensics + Lessons Learned

Kentucky Consumer Data Protection Act · 2 controls

MDS2 (Medical Device) · 2 controls

  • MDS2-PHI-Data-Handling-DATA-Storage-STCF-Transmission-TXCF-TXIG-Encryption-FIPS MDS2 PHI Handling + DATA + STCF Storage + TXCF Transmission + TXIG Integrity + Encryption + FIPS
  • MDS2-Roadmap-Third-Party-RDMP-Security-Guidance-SGUD-SBOM-Vulnerability-Disclosure-Programme MDS2 Roadmap + RDMP + Third Party + Security Guidance + SGUD + SBOM + Vulnerability Disclosure + Coordinated

Malaysia PDPA 2010 · 2 controls

  • MY-PDPA-Cross-Border-Transfer-Section-129-Whitelist-Abolition-2024-Adequacy-SCC-BCR-Processor-Direct-Marketing Malaysia PDPA Cross-Border + Section 129 + Whitelist Abolition 2024 + Adequacy + SCC + BCR + Processor + Marketing
  • MY-PDPA-Security-Principle-Retention-Data-Integrity-Breach-Notification-72-Hour-Section-12B-2024-Amendment Malaysia PDPA Security + Retention + Data Integrity + Breach Notification 72 Hour + Section 12B + 2024 Amendment

Maryland Online Data Privacy Act of 2024 · 2 controls

Monetary Authority of Singapore Technology Risk Management Guidelines · 2 controls

  • MAS-TRM-Cyber-Resilience-Chapter-11-Threat-Intelligence-Penetration-Testing-Incident-Response-1-Hour-Notification MAS TRM Cyber Resilience + Chapter 11 + Threat Intelligence + Penetration Testing + Incident Response + 1-Hour Notification
  • MAS-TRM-Governance-Chapters-2-3-Board-Senior-Management-Risk-Framework-Information-Asset-Management MAS TRM Governance + Chapters 2-3 + Board + Senior Management + Risk Framework + Information Asset Management

NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding) · 2 controls

  • STANAG-1 STANAG 4774 Confidentiality Label Schema and XML Structure
  • STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding

NIST SP 800-145 · 2 controls

  • NISTSP145-7 Cloud Procurement Standards Aligned to NIST SP 800-145 Definition
  • NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition

NIST SP 800-146 · 2 controls

  • NISTSP146-1 Cloud Adoption Strategy, Workload Suitability, and Decision Framework
  • NISTSP146-6 Cloud Security and Privacy Recommendations

NIST SP 800-61 Rev. 3 · 2 controls

  • NISTSP61-2 Computer Security Incident Response Team (CSIRT) Structure and Staffing
  • NISTSP61-5 Containment, Eradication, and Recovery

NIST SP 800-66 · 2 controls

  • NISTSP66-2 Workforce Security, Information Access Management, and Awareness Training
  • NISTSP66-6 Technical Safeguards: Access Control, Audit Controls, Integrity, Person Authentication

NIST SP 800-88 · 2 controls

  • NISTSP88-1 Media Sanitization Policy, Roles, and Decision Framework
  • NISTSP88-7 Verification, Audit, Training, and Environmental/Safety Controls

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity · 2 controls

  • NRC7354-2 Critical Digital Asset (CDA) Identification, Scope, and Boundary
  • NRC7354-4 Security Controls Implementation per NRC RG 5.71 Appendix B/C

NRF Cybersecurity and Data Privacy Framework (National Retail Federation) · 2 controls

  • NRFCS-2 Risk Assessment, Customer Data Inventory, Classification, and Retail Threat Model
  • NRFCS-7 Detection, Logging, Incident Response, Breach Notification, and Fraud Detection

New Jersey Data Privacy Act · 2 controls

  • NJDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal
  • NJDPA-6 Reasonable Data Security and Incident Response

New Zealand Information Security Manual (NZISM) · 2 controls

  • NZISM-1 NZISM Governance, Documentation, and Classification System
  • NZISM-5 Network Security, System Hardening, and Application Security

PCAOB AS 2201 - Audit of Internal Control Over Financial Reporting (ICFR) · 2 controls

  • ASTWO-7 Deficiency Evaluation, Material Weakness, and Communication
  • ASTWO-8 ICFR Opinion, Basis, Definition, Limitations, Combined vs Separate Reports

Science Based Targets Initiative (SBTi) - Net-Zero Standard · 2 controls

  • C1 Organizational Boundary
  • C3 Scope 1 and 2 Coverage

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 2 controls

US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule · 2 controls

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements · 2 controls

  • CYB-5 Cyber Incident Response Plan
  • USMTSA-2 Cybersecurity Assessment and CSO Designation

21 CFR Part 211 - Current Good Manufacturing Practice · 1 control

  • CFR211-A-3 Section 211.3 - Definitions

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-13 Board Accountability for Operational Risk Management

Azerbaijan Law on Personal Data (2010) · 1 control

  • AZ-DPA-2 Article 2 - Basic Concepts

COBIT 2019 · 1 control

  • COBIT-BAI02 Managed requirements definition

COSO Internal Control - Integrated Framework (2013) · 1 control

  • CA-12 Deploys Through Policies and Procedures

Canada ITSG-33 - IT Security Risk Management · 1 control

  • CA-ITSG33-SC-01 Security Control Catalogue

Connecticut Data Privacy Act (CTDPA) · 1 control

  • CTDPA-1 Definitions

DFARS 252.204-7012 - Safeguarding Covered Defense Information · 1 control

  • 7012(a) Definitions

Ecuador Ley Orgánica de Protección de Datos Personales (LOPDP) · 1 control

  • LOPDP-EC-Security-Processor-Breach-Notification-Articles-37-45-Encryption-72-Hour-SPDP-Notification-CSIRT Ecuador LOPDP Security + Processor + Breach Notification + Articles 37-45 + 72-Hour

FATF Recommendation 16 - Payment Transparency (Travel Rule) · 1 control

  • R.16-VATR.Unhosted Unhosted (self-hosted / non-custodial) wallet transfers - 2024 Targeted Update

FBI CJIS Security Policy · 1 control

  • CJIS-2 Security Awareness Training

FDA Quality Management System Regulation (QMSR) · 1 control

  • QMSR-ISO13485-Sec5 Management responsibility (ISO 13485:2016 Section 5 - incorporated via §820.10)

Family Educational Rights and Privacy Act (FERPA) · 1 control

  • FERPA-Safeguards-PTAC Data Security Safeguards for PII in Education Records (PTAC Best Practices, SPPO Guidance)

FedRAMP High · 1 control

  • CA-9 Internal System Connections

FedRAMP Moderate · 1 control

  • CA-9 Internal System Connections

Florida Digital Bill of Rights (FDBR) · 1 control

  • FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704)

French Sapin II Law (Law No. 2016-1691) · 1 control

  • Sapin2-Pillar1-Code-of-Conduct Pillar 1 - Anti-Corruption Code of Conduct

GLI-33 - Gaming Laboratories International Event Wagering Systems · 1 control

  • GLI33-EventWagering-System-Architecture GLI-33 Event Wagering System Architecture, Wager Engine, Odds Engine and Risk Management

HL7 FHIR Security Framework · 1 control

ICH E6(R3) - Good Clinical Practice · 1 control

IEEE 1686 · 1 control

  • IEEE1686-IR-Recovery-Reporting-Exercises-Drills-RECOV IEEE 1686 - Incident Response + Recovery from Failed Update + Reporting to Authorities + Coordination with Sector-Specific Agencies + Exercises and Drills

ILO Declaration on Fundamental Principles and Rights at Work (Core Conventions) · 1 control

ISO/IEC 23837:2023 · 1 control

  • 23837-1.1 Scope

ISO/IEC 27007:2020 · 1 control

  • 27007-5.2 Audit Programme Objectives

ISO/IEC 27010:2015 · 1 control

  • 27010-16.1 Continuity of Sharing

ISO/IEC 27031:2011 · 1 control

  • 27031-5.1 IRBC Policy

ISO/IEC 27050-1:2019 · 1 control

  • 27050-1.4 Terms and definitions

ISO/IEC 29115:2013 - Entity Authentication Assurance Framework · 1 control

  • 29115-3 Terms and definitions

ITU Radio Regulations and Space Security Standards · 1 control

  • ITU-Scope-Constitution-Convention-Radio-Regulations-WRC-Quadrennial-Treaty-Art1-Definitions ITU Constitution + Convention + Radio Regulations Scope + Article 1 Definitions + Article 2 Nomenclature + WRC World Radiocommunication Conference Quadrennial Treaty Process + Member States + Sector Members

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) · 1 control

Illinois Biometric Information Privacy Act (BIPA) · 1 control

  • BIPA-SEC5-1 Biometric Identifier Definition

India CERT-In Cyber Security Directions 2022 · 1 control

Indiana Consumer Data Protection Act · 1 control

  • INCDPA-Security-ReasonablePractices-Breach-Notification-Records-Encryption-Pseudonymisation Indiana CDPA Security + Reasonable Practices + Breach Notification + Indiana Breach Notification Law (IC 24-4.9) + Records + Encryption + Pseudonymisation + De-Identification

LGPD · 1 control

  • LGPD-BR-Security-Article-46-48-Breach-Notification-ANPD-Reasonable-Time-Incident-Response-CSIRT Brazil LGPD Security + Article 46-48 + Breach Notification + ANPD + Incident Response

Laos Law on Prevention and Combating Cybercrime (2015) · 1 control

  • LAOS-CC-LaoCERT-Incident-Response-National-Cybersecurity-Coordination-Article-22 Laos Cybercrime LaoCERT + Incident Response + National Cybersecurity Coordination + Article 22

Liechtenstein DPA · 1 control

MARS-E · 1 control

Mauritius DPA · 1 control

  • MU-DPA-Governance-DPO-Designation-Section-25-DPO-ROPA-DPIA-Codes-Section-38-Commissioner-Registration Mauritius DPA Governance + DPO + ROPA + DPIA + Codes Section 38 + Commissioner Registration

Mexico LFPDPPP · 1 control

  • MX-LFPDPPP-Governance-Officer-Reglamento-47-50-Security-Manual-57-Risk-Assessment-61-Self-Regulation-Parameters-2014 Mexico LFPDPPP Governance + Officer + Reglamento 47 + Security Manual 50 + Risk Assessment 57 + Self-Regulation Parameters 2014

Minnesota Consumer Data Privacy Act · 1 control

  • MN-CDPA-Chief-Privacy-Officer-Section-325O-06-MN-UNIQUE-Designation-Privacy-Programme-Training Minnesota CDPA Chief Privacy Officer + Section 325O.06 + MINNESOTA-UNIQUE Designation + Privacy Programme + Training

Modern Slavery Act 2018 (Australia) · 1 control

Montana Consumer Data Privacy Act · 1 control

  • MT-CDPA-Sensitive-Data-MCA-30-14-2802-Opt-In-Children-13-Parental-Consent-Minors-13-16-Opt-In Montana CDPA Sensitive Data + MCA 30-14-2802 + Affirmative Opt-In + Children Under 13 Parental + Minors 13-16 Opt-In

NAIC Insurance Data Security Model Law (MDL-668) · 1 control

  • NAIC-6 Cybersecurity Event Investigation and Notification - Sections 6 and 7

NERC CIP · 1 control

  • NERCCIP-6 Incident Reporting and Response Planning + Recovery Plans (CIP-008 + CIP-009)

NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205) · 1 control

  • PQC-4 FIPS 205 SLH-DSA Implementation - Stateless Hash-Based Digital Signature

NIST SP 800-122 · 1 control

Nevada Gaming Control Board Cybersecurity Requirements · 1 control

  • NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation

New Hampshire Data Privacy Act · 1 control

  • NHPA-6 Reasonable Data Security and Breach Response

Nigeria Data Protection Regulation (NDPR) · 1 control

  • NGNDPR-5 Security of Personal Data, Breach Notification, and DPIA under NDPR Section 2.6-Security

Nigeria Open Banking Regulatory Framework (CBN, 2023) · 1 control

  • NGOB-5 Fraud Monitoring, Incident Notification, and Reporting to CBN

Notifiable Data Breaches Scheme (Australia) · 1 control

  • AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold

OCC Heightened Standards (12 CFR Part 30, Appendix D) · 1 control

  • OCCHS-1 Scope, Applicability, and Definitions of Heightened Standards

Oregon Consumer Privacy Act · 1 control

  • OREGONCPA-3 Consent, Sensitive Data, Children and Teen Protections

PCI DSS 4.0 · 1 control

  • 2.2.2 2.2.2 Vendor default accounts managed

Privacy Act 1988 (Australia) · 1 control

  • AUPRV-7 Notifiable Data Breaches (NDB) Scheme, Incident Response

SWIFT CSCF · 1 control

  • SWIFTCSCF-1 Restrict Internet Access and Protect Critical Systems (Objective 1)

Singapore Cybersecurity Act 2018 · 1 control

  • SGCYBER-1 Critical Information Infrastructure (CII) Designation and Registration

TEFCA - Trusted Exchange Framework and Common Agreement · 1 control

  • TEFCAREC-1 Common Agreement Conformance and Onboarding

US Automated Commercial Environment (ACE) - CBP Trade Data Requirements · 1 control

  • ACE-CR-4 Cargo Release Authorization

US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements · 1 control

  • USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR)

US Foreign Corrupt Practices Act (FCPA) · 1 control

  • 15 U.S.C. § 78dd-2(h) Definition of Domestic Concern

USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement) · 1 control

  • USMCADIGITAL-1 Cross-Border Data Flows and Localisation

Vietnam Law on Cybersecurity (No. 116/2025/QH15) · 1 control

  • VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 351 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll OWASP DevSecOps Maturity Model (DSOMM) controls