UK Defence Standard 05-138 - Cyber Security for Defence Suppliers UKDEFSTD-1: Cyber Defence Cyber Risk Profile (CRP)

What else in your programme already covers this

This control maps to 249 controls across 148 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 7 controls

27557-1 Scope
27557-3 Terms and definitions
27557-4.3 Individual impact consideration
27557-6.3 Privacy risk assessment
27557-6.4 Privacy risk treatment
27557-6.6 Recording and reporting
27557-7.3 Risk-based privacy program implementation

NIST SP 800-30 · 6 controls

NISTSP30-1 Risk Management Strategy and Risk Assessment Programme Establishment
NISTSP30-2 Three-Tier Risk Assessment Scoping (Organisation, Mission/Business, Information System)
NISTSP30-3 Threat Source and Threat Event Identification
NISTSP30-4 Vulnerability and Predisposing Condition Identification
NISTSP30-6 Risk Determination, Uncertainty, and Sensitivity Analysis
NISTSP30-8 Risk Assessment Maintenance, Continuous Monitoring, and Integration with the RMF

FTC GLBA Safeguards Rule (16 CFR Part 314) · 4 controls

FTC-Safeguards-EffectiveDate-Small-Institution Effective Date, Small Institution Exemption and Sectoral Coordination (16 CFR 314.5, 314.6)
FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j))
FTC-Safeguards-Risk-Assessment Written Risk Assessment (16 CFR 314.4(b))
FTC-Safeguards-ServiceProvider-Evaluation Service Provider Oversight + Program Evaluation + Personnel Training (16 CFR 314.4(d-g))

IEEE 1686 · 4 controls

IEEE1686-IR-Recovery-Reporting-Exercises-Drills-RECOV IEEE 1686 - Incident Response + Recovery from Failed Update + Reporting to Authorities + Coordination with Sector-Specific Agencies + Exercises and Drills
IEEE1686-Section5.1-AccessControl-Accounts-Roles-Password-Session-Remote IEEE 1686 Section 5.1 - Electronic Access Account Management + Roles + Password + Failed Login + Session + Remote Access + Personnel
IEEE1686-Section5.5-5.6-5.7-5.8-Firmware-ConfigSW-TimeSync-DataAtRest IEEE 1686 Section 5.5-5.8 - Firmware Quality + Configuration Software Security + Time Synchronisation + Data Protection at Rest + Patch + Malware + Hardening + Vulnerability
IEEE1686-SupplyChain-Documentation-Procurement-ComplianceTable-Physical IEEE 1686 Section 6 IED Security Documentation + Supply Chain + Procurement Specification + Appendix A Compliance Table + Physical and Tamper

Japan AI Guidelines · 4 controls

JP-AIG-Continuous-Monitoring-Lifecycle-Model-Evaluation-Performance-Drift-Post-Deployment Japan AI Guidelines Continuous Monitoring + AI System Lifecycle Management + Model Evaluation + Performance Drift + Concept Drift + Post-Deployment + Retraining Triggers + Safe Update + Decommissioning + Model Card Versioning
JP-AIG-Fairness-Bias-Detection-Mitigation-Inclusive-AI-Discrimination-Prevention-10-Principles-2019-Heritage Japan AI Guidelines Fairness + Bias Detection + Mitigation + Inclusive AI + Discrimination Prevention + 10 Principles 2019 Heritage + Protected Attributes + Disparate Impact + Statistical Parity + Counterfactual Fairness
JP-AIG-Safety-Validation-Testing-Robustness-AISI-AI-Safety-Institute-Pre-Deployment-Evaluation-Red-Teaming Japan AI Guidelines Safety + Validation + Testing + Robustness + AISI AI Safety Institute (14 Feb 2024) + Pre-Deployment Evaluation + Red Teaming + Capability Evaluations + AI Incident Database + Safe Deployment + AI Safety Reports
JP-AIG-Scope-METI-MIC-AI-Guidelines-Business-v1.0-April2024-Society-5.0-Cabinet-Office-AI-Strategy-Council Japan AI Guidelines Scope + METI/MIC AI Guidelines for Business v1.0 (April 2024) + Society 5.0 + Cabinet Office AI Strategy Council + 10 Principles 2019 Heritage + Education + Literacy + Fair Competition + Innovation Principles

NIST SP 800-37 · 4 controls

NISTSP37-1 RMF Prepare Step: Organisation-Level and System-Level Preparation
NISTSP37-2 RMF Categorize Step: Information and System Categorisation
NISTSP37-3 RMF Select Step: Security and Privacy Control Selection
NISTSP37-7 RMF Monitor Step: Continuous Monitoring and Ongoing Authorisation

FISMA · 3 controls

FISMA-3554-Agency-Responsibilities Federal Agency Responsibilities (44 USC 3554) - CIO + CISO + Program + Reporting
FISMA-CIRCIA-ZTA-EO14028 CIRCIA, Zero Trust Architecture, EO 14028 + 14110 + OMB Memoranda
FISMA-NIST-800-53-RMF-800-171-FIPS Operationalisation via NIST 800-53 + 800-37 RMF + 800-171 + FIPS 199 + FIPS 200

German Supply Chain Due Diligence Act (LkSG) · 3 controls

LkSG-Sec4-RiskMgmt-Sec5-RiskAnalysis Section 4 Risk Management System + Section 5 Annual Risk Analysis
LkSG-Sec6-Policy-Preventive Section 6 Policy Statement and Preventive Measures (Own + Direct Suppliers)
LkSG-Sec7-IndirectSupplier-Sec8-Remedial Section 7 Indirect Supplier DD + Substantiated Knowledge Trigger + Section 8 Remedial Action

IATF 16949:2016 - Quality Management System for Automotive Production · 3 controls

IATF16949-Clause6-Planning-Risk-Contingency-Objectives-Change IATF 16949 Clause 6 - Planning + Risks and Opportunities + Contingency Plans + Quality Objectives + Change
IATF16949-Clause8-Operation-APQP-Design-Production-ControlPlan-SpecialChars IATF 16949 Clause 8 - Operation Planning + APQP + Design + Special Characteristics + Production + Control Plan + Set-Up Verification
IATF16949-Clause8-Supplier-QMS-Development-Externally-Provided IATF 16949 Clause 8 Supplier - Control of Externally Provided Processes + Type and Extent + Supplier QMS Development

IEC 60601-1 - Medical Electrical Equipment Safety · 3 controls

60601-1.4.1 General requirements
60601-1.4.2 Risk management process
60601-1.5.1 General requirements for testing

ISO/IEC 29134:2023 · 3 controls

29134-1 Scope
29134-3 Terms and definitions
29134-9.1 PIA report structure

NATO AQAP 2110 - Quality Assurance Requirements for Design, Development, and Production · 3 controls

AQAP2110-1 Quality Management System Aligned to ISO 9001 plus NATO Supplementary Requirements
AQAP2110-2 Government Quality Assurance Representative (GQAR) Authority and Access
AQAP2110-6 Subcontractor Supply Chain Control plus Counterfeit Material Prevention

NIST Privacy Framework · 3 controls

NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment
NISTPF-2 Govern-P - Governance Policies, Risk Management Strategy, Awareness Training, and Monitoring
NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

NIST SP 800-39 · 3 controls

NISTSP39-3 Risk Assessing: Organisation, Mission, and System Level Assessments
NISTSP39-4 Risk Responding: Identify, Evaluate, Decide, Implement
NISTSP39-5 Risk Monitoring: Effectiveness, Changes, Compliance, and Reassessment Triggers

NIST SP 800-61 Rev. 3 · 3 controls

NISTSP61-1 Incident Response Policy, Plan, and Procedures
NISTSP61-3 Preparation: Communications, Toolkits, Training, Exercises, Threat Intelligence
NISTSP61-4 Detection and Analysis: Sources, Triage, Categorisation, Prioritisation

Nevada Gaming Control Board Cybersecurity Requirements · 3 controls

NGCB-1 Regulation 5.260 Scope, Applicability, and Licensee Categories
NGCB-5 Technical Security Controls - Access + Network + Encryption + Vulnerability + Logging
NGCB-8 Annual Independent Cybersecurity Assessment + Reporting + Board Oversight

OWASP DevSecOps Maturity Model (DSOMM) · 3 controls

DSOMM-1 Culture, Organization, Education, and Governance
DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management
DSOMM-4 Test and Verification - SAST, DAST, IAST, SCA, Penetration Testing

FDA 21 CFR Part 11 · 2 controls

Part11.10 Controls for closed systems (21 CFR §11.10)
Part11.CSV Computer system validation + risk-based approach (21 CFR §11.10(a) + 2003 FDA Scope and Application Guidance + 2023 CSA draft)

FedRAMP Rev 5 · 2 controls

FedRAMP-Boundary Authorization Boundary, SSP, SAR, POA&M documentation
FedRAMP-SupplyChain-SBOM FedRAMP supply chain risk management + SBOM (per EO 14028 + NIST 800-218 SSDF)

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 2 controls

UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21)
UAE-PDPL-Art.25_26_27_28_29 UAE Data Office establishment, powers, penalties, complaints (UAE PDPL Articles 25-29)

French Sapin II Law (Law No. 2016-1691) · 2 controls

Sapin2-Pillar3-Risk-Mapping Pillar 3 - Corruption Risk Mapping (Cartographie des Risques)
Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A)

GS1 Global Standards - Supply Chain Traceability and Data Security · 2 controls

GS1-EPCIS-CBV-EventBasedDataSharing GS1 EPCIS (Electronic Product Code Information Services) and CBV (Core Business Vocabulary) Event-Based Data Sharing
GS1-Traceability-Healthcare-FMD-MDR-DSCSA-UDI GS1 Supply Chain Traceability, Healthcare + Pharma + Food Sectors, EU FMD + MDR + IVDR + TPD, FDA DSCSA + UDI

Ghana Cybersecurity Act · 2 controls

GhCSA-CII-Designation-Plan-Audit-Risk CII Designation, Registration, Cybersecurity Plan, Audit and Risk Assessment
GhCSA-Implementation-Roadmap Implementation Roadmap - Organizational Roles, Tooling and Metrics

HKMA Cyber Resilience Assessment Framework (C-RAF) · 2 controls

HKMA-CRAF-Domain1-2-Governance-Identification HKMA C-RAF Domain 1 (Governance) + Domain 2 (Identification) - Cyber Strategy, Risk Management, Asset Management, Threat Assessment
HKMA-CRAF-Domain3-4-Protection-Detection HKMA C-RAF Domain 3 (Protection) + Domain 4 (Detection) - Access, Data, Infrastructure, Application, Monitoring, Testing, Threat Intel

IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems · 2 controls

IACS-UR-E26-Identify-AssetInventory-CBS-NetworkArchitecture-Risk IACS UR E26 Identify Goal - Asset Inventory of Computer Based Systems + Network Architecture Documentation + Risk-Assessable Scope
IACS-UR-E26-Identify-Plan-Risk-Survey-Documentation IACS UR E26 Identify Goal - Ship Cyber Resilience Plan + CBS Risk Assessment + Survey + Documentation

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 2 controls

IAEA-NSS17-GradedApproach-SecurityLevels-Risk-DBT IAEA NSS-17 - Graded Approach + Computer Security Levels + Risk-Informed Methodology + Threat Assessment + DBT Alignment + Consequence Analysis
IAEA-NSS17-SupplyChain-ThirdParty-OEM-Trust IAEA NSS-17 - Supply Chain + Third Party + OEM + Vendor Security + Trustworthy Components

ICAO Annex 17 - Aviation Security (AVSEC) · 2 controls

ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18)
ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain

ICH Q10 - Pharmaceutical Quality System · 2 controls

ICH-Q10-Section1-Enablers-KnowledgeMgmt-QRM-FoundationICH-Q8-Q9 ICH Q10 Section 1 - PQS Enablers + Knowledge Management + Quality Risk Management (ICH Q9 Foundation)
ICH-Q10-Section2-Outsourced-Ownership-Vendor-Supplier-CMO-CRO ICH Q10 Section 2 - Outsourced Activities + Management of Materials + Change of Ownership + CMO + CRO + Supplier Management

IEEE 7000 · 2 controls

IEEE7000-EthicalRisk-Identification-Analysis-Treatment-ValidationOutcomes IEEE 7000 Clauses 8 + 8.1 + 8.2 - Ethical Risk Identification + Analysis + Treatment + Validation of Ethical Outcomes + AI Safety + Robustness + Adversarial Protection
IEEE7000-Values-Elicitation-Prioritisation-IEEE7000Family-Bias-Privacy-Transparency IEEE 7000 Clauses 6 + 6.1 - Ethical Values Elicitation + Prioritisation + IEEE 7000 Family Integration (Bias + Privacy + Transparency + Wellbeing)

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.4) · 2 controls

IMO-MSC-FAL-Identify-AssetInventory-ThreatsVulnerabilities-CyberRiskAssessment-RolesResponsibilities IMO MSC-FAL Identify Function - OT/IT Asset Inventory + Threats + Vulnerabilities + Cyber Risk Assessment + Roles and Responsibilities + Crew + CSO + DPA
IMO-MSC-FAL-Protect-AccessControl-NetworkSegmentation-MalwareDefence-Patch-Awareness-DataSecurity IMO MSC-FAL Protect Function - Access Control + Network Segmentation + Malware Defence + Patch Management + Awareness Training + Data Security + Crew BYOD + Removable Media

IRM/AIRMIC/ALARM A Risk Management Standard (2002) · 2 controls

IRM-Process-Identification-Analysis-Evaluation-Treatment-Monitoring-Review-ISO31000-Aligned IRM Risk Management Process - 5-Stage Cycle + Identification + Analysis (Inherent/Residual) + Evaluation + Treatment (4Ts Tolerate/Treat/Transfer/Terminate) + Monitoring + Review + Communication + Risk Register
IRM-RiskCategories-Strategic-Financial-Operational-Knowledge-FOIL-External-Internal-DownsideUpside IRM Four Risk Categories - Strategic + Financial + Operational + Knowledge + FOIL Typology + External vs Internal + Downside Threats and Upside Opportunities + Risk Universe

ISO/IEC 27010:2015 · 2 controls

27010-15.1 Incident Management
27010-8.1 Membership Onboarding

ISO/IEC 27011:2024 · 2 controls

27011-5.6 Supplier relationships and telecom supply chain
27011-6.3 Awareness and Training

Lloyd's of London Cyber Insurance Requirements and Underwriting Standards · 2 controls

LLOYDS-CI-Risk-Selection-Cyber-Hygiene-Underwriting-Criteria-Pre-Bind-Risk-Engineering-MFA-Backup-EDR Lloyds Cyber Insurance Risk Selection + Hygiene + Pre-Bind Engineering
LLOYDS-CI-Systemic-Cyber-Risk-Aggregation-Cyber-Catastrophe-Modelling-Vendor-Use-RDS-Scenario-Testing Lloyds Cyber Insurance Systemic Aggregation + Catastrophe Modelling + RDS

MARS-E · 2 controls

MARS-E-NIST-800-53-Moderate-Baseline-Catalog-v2-0-Volume-III-Tailoring-Risk-Assessment-Categorization MARS-E NIST 800-53 Moderate Baseline + MARS-E Catalog Volume III + Tailoring + Risk Assessment + Categorization
MARS-E-Privacy-PII-PHI-Minimum-Necessary-HIPAA-Privacy-Rule-NIST-800-122-45-CFR-164-Subpart-E MARS-E Privacy + PII + PHI + Minimum Necessary + HIPAA Privacy Rule + NIST 800-122 + 45 CFR 164 Subpart E

MDS2 (Medical Device) · 2 controls

MDS2-Audit-Logging-AUDT-Integrity-IGAU-Cybersecurity-Risk-CYBR-Monitoring MDS2 Audit Controls + AUDT + Integrity + IGAU + Cybersecurity Risk + CYBR + Continuous Monitoring
MDS2-Roadmap-Third-Party-RDMP-Security-Guidance-SGUD-SBOM-Vulnerability-Disclosure-Programme MDS2 Roadmap + RDMP + Third Party + Security Guidance + SGUD + SBOM + Vulnerability Disclosure + Coordinated

MITRE ATT&CK · 2 controls

MITRE-ATTACK-Tactics-14-Enterprise-Kill-Chain-Reconnaissance-Initial-Access-Discovery-Lateral-Movement-Impact MITRE ATT&CK 14 Enterprise Tactics + Reconnaissance + Initial Access + Discovery + Lateral Movement + Impact
MITRE-ATTACK-Techniques-Sub-Techniques-200-600-T1078-T1059-T1566-T1190-T1486-Procedures-Adversary-Behaviour MITRE ATT&CK Techniques + 200+ + Sub-Techniques + 600+ + T1078 + T1059 + T1566 + T1190 + T1486 + Procedures

MITRE D3FEND · 2 controls

MITRE-D3FEND-Harden-Tactic-Application-Credential-Message-Platform-Hardening-MFA-Encryption-Secure-Boot MITRE D3FEND Harden Tactic + Application + Credential + Message + Platform + MFA + Encryption + Secure Boot
MITRE-D3FEND-Model-Tactic-System-Inventory-Network-Mapping-Identity-Discovery-Asset-Identification MITRE D3FEND Model Tactic + System Inventory + Network Mapping + Identity Discovery + Asset Identification

Modern Slavery Act 2018 (Australia) · 2 controls

AU-MSA-Mandatory-Criteria-1-2-Identity-Structure-Operations-Supply-Chain-Section-16-1a-16-1b Australia MSA Mandatory Criteria 1 + 2 + Identity + Structure + Operations + Supply Chain + Section 16(1)(a) + (b)
AU-MSA-Mandatory-Criterion-3-Modern-Slavery-Risks-Operations-Supply-Chain-Section-16-1c-Sector-Geographic-Indicators Australia MSA Mandatory Criterion 3 + Modern Slavery Risks + Section 16(1)(c) + Sector + Geographic Indicators

NAIC Insurance Data Security Model Law (MDL-668) · 2 controls

NAIC-1 NAIC Model Law Adoption, Scope, and Licensee Definitions
NAIC-2 Information Security Program (ISP) - Section 4

NERC CIP · 2 controls

NERCCIP-5 System Security Management + Configuration Change Management and Vulnerability Assessments (CIP-007 + CIP-010)
NERCCIP-8 Supply Chain Risk Management (CIP-013)

NIST SP 800-66 · 2 controls

NISTSP66-1 Security Management Process: Risk Analysis and Risk Management for ePHI
NISTSP66-2 Workforce Security, Information Access Management, and Awareness Training

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 2 controls

NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration
NISTSP82-2 OT Risk Assessment and Threat/Vulnerability Identification

NIST SP 800-88 · 2 controls

NISTSP88-1 Media Sanitization Policy, Roles, and Decision Framework
NISTSP88-5 Media Inventory, Tracking, Chain of Custody, and Sanitization Records

NIST SP 800-92 · 2 controls

NISTSP92-2 Log Generation: OS, Application, Security Tools, Network, Cloud, Required Event Content
NISTSP92-7 Privacy in Logs, Sensitive Content Handling, Cloud and SaaS Log Considerations

NRF Cybersecurity and Data Privacy Framework (National Retail Federation) · 2 controls

NRFCS-1 Retail Cybersecurity Governance, Policy, and Regulatory Change Management
NRFCS-2 Risk Assessment, Customer Data Inventory, Classification, and Retail Threat Model

Nebraska Data Privacy Act · 2 controls

NDPA-1 Applicability, Scope, and Carve-Outs
NDPA-7 Data Protection Assessments and Processor Contracts

New Zealand Information Security Manual (NZISM) · 2 controls

NZISM-1 NZISM Governance, Documentation, and Classification System
NZISM-3 Personnel Security, Physical Security, and Cryptography

Nigeria Data Protection Act 2023 (NDPA) · 2 controls

NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission
NG-NDPA-7 Cross-Border Data Transfers and International Cooperation

OCC Heightened Standards (12 CFR Part 30, Appendix D) · 2 controls

OCCHS-3 Risk Appetite Statement, Risk Limits, Concentration Risk, and Limit Breach Protocols
OCCHS-7 Risk Data Aggregation, Reporting, Talent, Compensation, and Strategic Planning

OECD AI Principles · 2 controls

OECDAI-3 Robustness, Security, Safety, and Adversarial Attack Protection
OECDAI-5 Data Governance, Training Data Quality, Privacy, and Bias Mitigation

OSFI B-13 · 2 controls

OSFIB13-1 Governance, Risk Management, and Three Lines of Defense
OSFIB13-4 Third-Party Risk Management and Cloud

OWASP SAMM · 2 controls

OWASPSAMM-2 Design: Threat Assessment, Security Requirements, Security Architecture
OWASPSAMM-5 Operations: Incident Management, Environment Management, Operational Management

Own Risk and Solvency Assessment (ORSA) - NAIC Model Act · 2 controls

ORSA-S1 Guidance Manual Section 1: Description of the insurer's risk management framework
ORSA-S2 Guidance Manual Section 2: Insurer's assessment of risk exposures

PCAOB AS 2201 - Audit of Internal Control Over Financial Reporting (ICFR) · 2 controls

ASTWO-1 Audit Planning, Scaling, Risk Assessment, and Integration
ASTWO-3 Entity-Level Controls and Period-End Financial Reporting Process

PIC/S Guide to Good Manufacturing Practice for Medicinal Products · 2 controls

PICSGMP-1 Chapter 1: Pharmaceutical Quality System (PQS) and Quality Risk Management
PICSGMP-7 Chapter 7: Outsourced Activities and Supplier Management

PSD2 SCA · 2 controls

PSDTWO-1 Strong Customer Authentication (SCA) Core Requirements
PSDTWO-3 Common and Secure Communication, API Access for AISPs and PISPs

SASB Standards · 2 controls

SASB-1 Business Model + Innovation (BMI)
SASB-3 Leadership and Governance (LG)

SIG (Shared Assessments) · 2 controls

SHAREASSESS-1 Information Governance and Risk
SHAREASSESS-2 Access Control, Identity, Authentication

SQF Code Edition 9 - Safe Quality Food · 2 controls

2.4.4 Hazard Analysis and Risk Assessment
2.7.2 Food Fraud Plan

TISAX - Trusted Information Security Assessment Exchange · 2 controls

TISAXASS-1 Assessment Levels and Process
TISAXASS-2 ISA Catalog Implementation

US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule · 2 controls

USGLBAHIGHER-1 Qualified Individual and Risk Assessment
USGLBAHIGHER-3 Continuous Monitoring, Testing, Vendor Oversight

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

4.3.1 Risk Assessment and Impact Analysis

Ecuador Ley Orgánica de Protección de Datos Personales (LOPDP) · 1 control

LOPDP-EC-Governance-DPO-ROPA-DPIA-Privacy-by-Design-Training-Articles-46-58-Compliance-Monitoring Ecuador LOPDP Governance + DPO + ROPA + DPIA + Privacy by Design + Training

FATF Recommendation 16 - Payment Transparency (Travel Rule) · 1 control

R.16-VATR.Unhosted Unhosted (self-hosted / non-custodial) wallet transfers - 2024 Targeted Update

FDA Quality Management System Regulation (QMSR) · 1 control

QMSR-ISO13485-Sec7_Purchasing Purchasing controls + supplier management (ISO 13485:2016 Section 7.4)

FIRST CSIRT Services Framework and Standards · 1 control

FIRST-CSIRTF-SA5-KnowledgeTransfer Service Area 5 - Knowledge Transfer (Awareness, Training, Exercises, Advisory)

FSSC 22000 - Food Safety System Certification · 1 control

FSSC-Additional-Requirements-v6 FSSC 22000 Additional Requirements v6 (Food Defense + Food Fraud + Allergen + Environmental + Culture)

Family Educational Rights and Privacy Act (FERPA) · 1 control

FERPA-Safeguards-PTAC Data Security Safeguards for PII in Education Records (PTAC Best Practices, SPPO Guidance)

Florida Digital Bill of Rights (FDBR) · 1 control

FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711)

GAMP 5 - Good Automated Manufacturing Practice · 1 control

GAMP5-2nd-Edition-AI-Cloud-Agile-CSA 2nd Edition (2022) - AI/ML, Cloud, Agile, DevOps and Computer Software Assurance (CSA)

GLBA · 1 control

GLBA-Subordinate-Rules-Operationalisation GLBA Operationalisation through FTC Safeguards Rule, Privacy Rule, SEC Reg S-P and Banking-Agency Guidelines

GLI-33 - Gaming Laboratories International Event Wagering Systems · 1 control

GLI33-EventWagering-System-Architecture GLI-33 Event Wagering System Architecture, Wager Engine, Odds Engine and Risk Management

GLOBALG.A.P. Integrated Farm Assurance (IFA) Standard v6 · 1 control

GGAP-IFA-AllFarmBase-Mgmt-Workers-Env-Trace GLOBALG.A.P. IFA v6 All Farm Base (AF): Management, Workers, Environment, Traceability and Food Safety

Global Cross-Border Privacy Rules (Global CBPR) Forum · 1 control

CBPR-9-APEC-Privacy-Principles Global CBPR Forum: 9 APEC Privacy Principles (Notice + Collection + Uses + Choice + Integrity + Security + Access + Accountability + Preventing Harm)

HKMA SPM · 1 control

HKMA-SPM-OR-RR-SA-OperationalResilience HKMA SPM Operational Risk (OR-1), Operational Resilience (OR-2), Recovery Planning (RR-1), Outsourcing (SA-2)

IATA Operational Safety Audit (IOSA) Standards Manual · 1 control

IATA-IOSA-Section8-SEC-SecurityManagement-AVSEC IATA IOSA Section 8 - SEC Security Management + Aviation Security Programme (AVSEC) + ICAO Annex 17 Alignment

ICH E6(R3) - Good Clinical Practice · 1 control

ICH-E6-Scope-Principles-R3-2025-Risk-Based-DecentralisedClinical ICH E6 Good Clinical Practice - Scope + 13 Principles + R3 January 2025 + Risk-Based + Decentralised + Modernisation

ICMM Mining Principles (2024 Update) · 1 control

ICMM-MP-P3-P4-HumanRights-RiskMgmt-UNGP-DueDiligence ICMM Mining Principles 3 + 4 - Human Rights (UNGPs Alignment) + Risk Management + Due Diligence

ISMAP (Japan) · 1 control

ISMAP-CloudGovernance-ISMS-RiskAssessment-SharedResponsibility-Policy-RegulatoryCompliance-RolesResponsibilities ISMAP Cloud Governance - ISMS per ISO 27001/JIS Q 27001 + Risk Assessment + Shared Responsibility Model + Cloud Security Policy + Regulatory Compliance + Roles and Responsibilities

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 1 control

A.1 Point-of-Care Testing Additional Requirements

ISO/IEC 27031:2011 · 1 control

27031-7.2 Resource Requirements

ISO/IEC 29147:2018 · 1 control

29147-5.11 Researcher Safe Harbour and Legal Posture

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) · 1 control

ICELAND-Act90-Chap4-Security-BreachNotification-DPIA-Personuvernd-72hr Iceland Act 90/2018 - Chapter IV Security of Processing + Breach Notification + DPIA (Articles 27-29)

India CERT-In Cyber Security Directions 2022 · 1 control

CERTIN-IncidentReporting-6Hour-Mandatory-Format-POC-20Categories-Section70B-Dir1to4 CERT-In Directions 1-4 Incident Reporting - Mandatory 6-Hour Window + 20 Categories + Standardised Report Format + Designated Point of Contact + 24x7 Channel

India DPDP Act · 1 control

DPDP-SignificantDataFiduciary-SDF-Sec10-DPO-IndependentAuditor-DPIA-Algorithmic DPDP Act Sections 10-11 + Significant Data Fiduciary (SDF) + Data Protection Officer + Independent Data Auditor + DPIA + Algorithmic Software Audit + Privacy by Design + Records of Processing Activities

Indiana Consumer Data Protection Act · 1 control

INCDPA-SensitiveData-Children-Consent-COPPA-DataProtectionAssessment-DPIA Indiana CDPA Sensitive Data + Consent for Sensitive Categories + Children Under 13 + COPPA Coordination + Data Protection Assessment (DPA) + High-Risk Processing

Indonesia PDP Law · 1 control

IDPdp-Controller-DPO-ROPA-DPIA-PrivacyByDesign-Art20to46-Accuracy-Accountability Indonesia PDP Articles 20-46 + Controller Obligations + DPO Appointment + ROPA + DPIA + Privacy by Design + Accuracy + Accountability + Risk Assessment + Documentation

Iowa Consumer Data Protection Act · 1 control

ICDPA-SensitiveData-Notice-OptOut-NotConsent-Children-COPPA-Alignment-De-Identification Iowa CDPA Sensitive Data + Notice + Opt-Out (NOT Consent unlike VCDPA) + Children Under 13 + COPPA Alignment + De-Identification Standards + Heightened Risk Awareness

Jamaica Data Protection Act 2020 · 1 control

JM-DPA2020-Privacy-by-Design-Default-Sec34-Engineering-Data-Protection-Impact-Assessment-DPIA-Risk-Based Jamaica DPA 2020 Privacy by Design + Privacy by Default + Section 34 + Data Protection Impact Assessment (DPIA) + Risk-Based + High-Risk Processing + Prior Consultation + Privacy Engineering

Kentucky Consumer Data Protection Act · 1 control

KY-CDPA-Data-Protection-Assessment-DPA-Targeted-Advertising-Sale-Sensitive-Profiling-Substantial-Risk Kentucky CDPA Data Protection Assessment (DPA) + Section 6 + Targeted Advertising + Sale + Sensitive Data + Profiling Substantial Injury + Maintained Records + Attorney General Access + 4 Categories Requiring DPA + Risk-Benefit Analysis

LGPD · 1 control

LGPD-BR-Governance-Encarregado-DPO-ROPA-DPIA-Privacy-by-Design-Article-46-50-Codes-of-Conduct Brazil LGPD Governance + Encarregado (DPO) + ROPA + DPIA + Articles 46-50

Law No. 172-13 on the Protection of Personal Data · 1 control

DOM172-Supervisory-Authority-Cooperation-Sanctions-Penalties-Articles-77-79-Awareness-Training-Retention-DPO-Designation Dominican Republic Law 172-13 Supervisory Authority + Sanctions + Articles 77-79 + DPO + Awareness

Liechtenstein DPA · 1 control

LIDPA-Governance-DPO-ROPA-DPIA-Privacy-by-Design-Articles-32-39-Codes-of-Conduct-Whistleblowing Liechtenstein DPA Governance + DPO + ROPA + DPIA + Articles 32-39 + Whistleblowing

MTCS (Singapore) · 1 control

MTCS-Governance-ISMS-Risk-HR-Lifecycle-Compliance-Cloud-Strategy-Roles-Responsibilities MTCS Governance + ISMS + Risk Management + HR Security + Cloud Service Lifecycle + Compliance + Roles

Malaysia PDPA 2010 · 1 control

MY-PDPA-DPO-Designation-Class-Data-User-Registration-DPIA-Code-Practice-Section-43A-2024-Amendment Malaysia PDPA Governance + DPO Section 43A + Class of Data User Registration + DPIA + Code of Practice

Maryland Online Data Privacy Act of 2024 · 1 control

MD-MODPA-Pseudonymisation-De-Identification-Section-14-4610-4611-Internal-Research-Aggregated Maryland MODPA Pseudonymisation + De-Identification + Section 14-4610 + 14-4611 + Internal Research + Aggregated

Mauritius DPA · 1 control

MU-DPA-Cross-Border-Transfer-Section-36-Adequacy-SCC-BCR-Mauritius-Global-Business-IBC-Financial-Services Mauritius DPA Cross-Border + Section 36 + Adequacy + SCC + BCR + Mauritius Global Business + Financial Services

Mexico LFPDPPP · 1 control

MX-LFPDPPP-Cross-Border-Transfer-Articles-36-37-Reglamento-66-68-Domestic-International-APEC-CBPR-USMCA Mexico LFPDPPP Cross-Border + Articles 36-37 + Reglamento 66 + 68 + Domestic + International + APEC CBPR + USMCA

Minnesota Consumer Data Privacy Act · 1 control

MN-CDPA-Data-Privacy-Assessment-DPIA-Section-325O-07-Sensitive-Targeted-Sale-Profiling-AI-Consumer-Health Minnesota CDPA DPIA + Section 325O.07 + Sensitive + Targeted + Sale + Profiling + AI + Consumer Health

Monetary Authority of Singapore Technology Risk Management Guidelines · 1 control

MAS-TRM-Third-Party-IT-Audit-Chapters-14-15-Outsourcing-Notice-658-Concentration-Risk-Exit-Strategy MAS TRM Third Party + IT Audit + Chapters 14-15 + Outsourcing + Notice 658 + Concentration Risk + Exit Strategy

Montana Consumer Data Privacy Act · 1 control

MT-CDPA-Data-Protection-Assessment-MCA-30-14-2815-Sensitive-Targeted-Sale-Profiling-AG-Inspection Montana CDPA Data Protection Assessment + MCA 30-14-2815 + Sensitive + Targeted + Sale + Profiling + AG Inspection

NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment) · 1 control

NISTSP115-8 Operational Considerations - Tools, Reporting Templates, ISMS Integration, Annex Material

NIST SP 800-122 · 1 control

NISTSP122-8 Continuous Monitoring, Training, and Privacy Programme Governance

NIST SP 800-123 · 1 control

NISTSP123-8 Governance, Policies, and ISMS Integration

NIST SP 800-137 · 1 control

NISTSP137-1 ISCM Strategy, Governance, and Volatility Assessment

NIST SP 800-144 · 1 control

NISTSP144-1 Cloud Governance, Risk Assessment, and Provider Trust Evaluation

NIST SP 800-145 · 1 control

NISTSP145-7 Cloud Procurement Standards Aligned to NIST SP 800-145 Definition

NIST SP 800-146 · 1 control

NISTSP146-1 Cloud Adoption Strategy, Workload Suitability, and Decision Framework

NIST SP 800-63-4 · 1 control

NISTSP63R4-7 Privacy, Records Retention, and User-Controlled Wallets

New Hampshire Data Privacy Act · 1 control

NHPA-7 Data Protection Assessments and Processor Contracts

New Jersey Data Privacy Act · 1 control

NJDPA-7 Data Protection Assessments and Processor Contracts

Nigeria Data Protection Regulation (NDPR) · 1 control

NGNDPR-5 Security of Personal Data, Breach Notification, and DPIA under NDPR Section 2.6-Security

Nigeria Open Banking Regulatory Framework (CBN, 2023) · 1 control

NGOB-1 Open Banking Registry Participation, Tiered Categorisation, and KYP

O-RAN WG11 Security Specification · 1 control

ORANWG11-1 O-RAN Threat Model, Risk Management, and Security Architecture

OECD Guidelines for Multinational Enterprises on Responsible Business Conduct (2023 Update) · 1 control

OECDMNE-5 Environment, Climate, and Biodiversity

OECD Recommendation on Artificial Intelligence (2024 Update) · 1 control

OECDAI24-3 Frontier Model Risk Management, Capability Disclosure, and Independent Evaluation

OWASP ASVS · 1 control

OWASPASVS-8 Data Protection (V8 + V8.3)

OWASP MASVS · 1 control

OWASPMASVS-1 MASVS-STORAGE: Storage of Sensitive Data

OWASP Top 10 for LLM Applications 2025 · 1 control

OWASPLLM-4 Supply Chain and Vector/Embedding Weaknesses (LLM03 + LLM08)

OWASP Top 10:2025 · 1 control

OWASPTOP10-3 A03:2025 Injection Including Cross-Site Scripting

Oman National Cybersecurity Framework · 1 control

OMANCS-8 Third-Party + Supply Chain Risk, Awareness Training, Physical Security, Compliance Audit

Ontario Accessibility for Ontarians with Disabilities Act (AODA) - IASR Web Standard · 1 control

AODACAN-2 Accessible Procurement of Goods, Services, Facilities

Open Banking Security · 1 control

OPENBANK-4 Third Party Provider (TPP) Onboarding, Directory Integration, Due Diligence

OpenSSF Scorecard · 1 control

OSSFSC-2 Dependency Management, Pinning, Updates, Vulnerability Tracking

Oregon Consumer Privacy Act · 1 control

OREGONCPA-5 Data Protection Assessments, Privacy by Design, Security Practices

PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments · 1 control

PASONE-3 Personnel Security, Vetting, Awareness, and Training

PDPA Singapore · 1 control

PDPASG-4 Children's Data, DPIA, and Privacy by Design

PDPA Thailand · 1 control

PDPATH-4 DPIA, Privacy by Design, Children's Data

POPIA · 1 control

POPIASA-4 Special Personal Information, Children, Information Quality, Documentation

PTES · 1 control

PTESPHASE-1 Pre-Engagement Interactions and Scoping

Personal Data Act (personopplysningsloven) · 1 control

NORWAY-4 DPIA, Privacy by Design, Records of Processing

Privacy Act 1988 (Australia) · 1 control

AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children

Privacy Act 2020 · 1 control

NZPRV-6 IPP 13 Unique Identifiers, Privacy Impact Assessment, Privacy by Design

Protective Security Policy Framework (PSPF) Release 2026 · 1 control

PSPF24-1 Security Culture, Governance, Risk Management

Qatar DPL · 1 control

QATAR-7 DPO, Records, Retention, Marketing, Training

SA8000:2014 - Social Accountability Standard · 1 control

SAEIGHT-7 Management System, Worker Engagement, Continuous Improvement

SEC Climate Disclosure Rule · 1 control

SECCLIM-2 Risk Management: Identification, Assessment, Integration

SLSA · 1 control

SUPCHAIN-1 Build Integrity - Source, Build, Provenance

Secure by Design: A Guide for Manufacturers (CISA) · 1 control

CISABD-3 Build Organizational Structure and Leadership for Secure Outcomes

Sigstore - Software Artifact Signing and Verification · 1 control

SIGSTORE-2 Transparency Log (Rekor) and Verification

South Korea PIPA · 1 control

PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33

TSA Pipeline Cybersecurity Directives · 1 control

TSAPIPE-1 Cybersecurity Implementation Plan and Coordinator

Taiwan PDPA · 1 control

TAIWAN-3 Data Subject Rights

Texas Data Privacy and Security Act (TDPSA) · 1 control

TEXASTDPSA-3 Sensitive Data, Children, Sale Notice

Turkey KVKK · 1 control

TURKEYKVKK-3 Special Categories and Sensitive Data

UK AI Regulation Framework · 1 control

UKAI-1 Risk-Based Approach and Pro-Innovation Principles

UK GDPR (UK General Data Protection Regulation) · 1 control

UKGDPRREG-3 Controller and Processor (Articles 24-43)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.