These frameworks apply across multiple industries. We assess which ones apply to your organization and build accordingly.
🏥 HIPAA
Healthcare providers, insurers, and business associates. Protects patient health information (PHI). Requires encryption, access controls, audit logs, and Business Associate Agreements (BAAs).
- Private AI deployment (no public APIs)
- Data encryption at rest and in transit
- Role-based access controls
- Comprehensive audit logging
- Automatic session timeouts
📚 FERPA
Educational institutions and related agencies. Protects student education records. Applies to K-12, colleges, universities, and any organization receiving Department of Education funds.
- Parental consent requirements
- Directory information restrictions
- Third-party provider agreements
- Data minimization practices
- Annual policy notifications
🇪🇺 GDPR
Organizations processing EU resident data. Comprehensive privacy rights including access, correction, deletion ("right to be forgotten"), and data portability.
- Lawful basis documentation
- Data Processing Agreements (DPAs)
- Privacy by design architecture
- Data subject request workflows
- Cross-border transfer safeguards
🇺🇸 CCPA/CPRA
California consumer privacy rights. Similar to GDPR but with distinct requirements. Applies to businesses meeting revenue or data processing thresholds.
- "Do Not Sell" mechanisms
- Consumer disclosure requirements
- Opt-out preference signals
- Service provider contract terms
- Annual compliance assessments
🏦 GLBA
Financial institutions. Gramm-Leach-Bliley Act requires safeguards for customer financial data. Applies to banks, credit unions, insurers, tax preparers, and more.
- Written information security program
- Risk assessments and mitigation
- Vendor oversight requirements
- Employee training programs
- Incident response procedures
💳 PCI-DSS
Payment card industry standards. Required for any organization storing, processing, or transmitting credit card data. Twelve core requirements across six control objectives.
- Network segmentation
- Cardholder data encryption
- Access control measures
- Regular security testing
- Information security policies
🛡️ NIST SP 800-171
Required for defense contractors handling CUI (Controlled Unclassified Information). DFARS 252.204-7012 mandates implementation. 110 security controls across 14 families covering access control, incident response, and system integrity.
- CUI data isolation and access controls
- On-premise deployment (no cloud data export)
- Audit logging and incident response
- Configuration management and FIM
- System and communication protection
🏛️ NIST SP 800-53
Security and privacy controls framework for federal information systems. Applicable to government agencies and contractors operating federal systems. Provides a comprehensive catalog of controls across 18 families.
- Access control (AC) and audit (AU) controls
- System and communication integrity (SC, SI)
- Contingency planning (CP) and backup
- Configuration management (CM)
- Risk assessment and continuous monitoring
🎖️ CMMC 2.0 Level 2
Cybersecurity Maturity Model Certification for defense contractors. Requires all 110 NIST 800-171 controls plus formal assessment by a C3PAO. Becoming a prerequisite for DoD contract award.
- All NIST 800-171 controls implemented
- SSP (System Security Plan) documentation
- POA&M (Plan of Action and Milestones)
- C3PAO assessment readiness support
- Continuous compliance maintenance
🔒 ISO/IEC 27001
Information Security Management Systems (ISMS). The most widely recognized information security standard globally. Organizations get certified against this. Many government contractors, healthcare organizations, and enterprises require ISO 27001 certification from their vendors.
- ISMS implementation and documentation
- Risk assessment and treatment plan
- Security policies and procedures
- Statement of Applicability (SoA)
- Internal audit and management review
📋 ISO/IEC 27002
Code of practice for information security controls. The companion to ISO 27001, providing detailed implementation guidance for security controls. Not certifiable on its own but implemented as part of a 27001 program or as standalone best practice.
- Information security policies
- Organization of information security
- Human resource security controls
- Access control and cryptography
- Operations and communications security
☁️ ISO/IEC 27017
Cloud security controls. Extends ISO 27001 and 27002 with cloud-specific guidance. Relevant for organizations using or providing cloud services. Defines shared responsibility between cloud provider and customer.
- Cloud-specific security controls
- Shared responsibility framework
- Virtual environment segmentation
- Cloud tenant data isolation
- Cloud service provider monitoring
🔐 ISO/IEC 27018
Protection of personally identifiable information (PII) in public clouds. Privacy-focused extension of ISO 27001. Aligns with GDPR and CCPA requirements for cloud-hosted personal data. Demonstrates privacy by design in cloud deployments.
- PII classification and handling
- Privacy impact assessments
- Data subject consent management
- Cross-border data transfer controls
- Privacy breach notification procedures
🤖 ISO/IEC 42001
AI Management System standard. The international standard for AI governance, risk management, and accountability. Defines requirements for organizations developing, providing, or using AI systems. New standard specifically for AI governance.
- AI risk assessment and management
- AI data governance and quality
- Transparency and explainability
- AI incident response and monitoring
- Model evaluation and continuous improvement
📊 SOC 2 (TSC)
Service Organization Control 2, Trust Services Criteria. Audited by CPA firms against Security, Availability, Processing Integrity, Confidentiality, and Privacy principles. Any organization providing services to enterprise customers gets asked for SOC 2 reports.
- Security and availability controls
- Processing integrity verification
- Confidentiality and privacy controls
- CPA audit readiness support
- Type I and Type II report preparation
🏛️ FedRAMP
Federal Risk and Authorization Management Program. Required for cloud services used by federal agencies. Standardizes security assessment, authorization, and continuous monitoring for cloud products and services. Three impact levels: Low, Moderate, High.
- Security assessment and authorization
- Continuous monitoring program
- System Security Plan (SSP)
- 3PAO assessment readiness
- Authorization package preparation
📦 ITAR / EAR
International Traffic in Arms Regulations and Export Administration Regulations. Controls export and transfer of defense articles, technical data, and dual-use items. Applies to defense contractors, manufacturers, and anyone handling export-controlled technology.
- Technical data classification
- Export license determination
- Access control for foreign nationals
- Compliance program development
- DDTC and BIS registration support
📈 SOX
Sarbanes-Oxley Act. Financial reporting and corporate governance requirements for public companies. Sections 302 and 404 require internal controls over financial reporting. Any system that touches financial data or reporting falls under SOX scope.
- Internal controls over financial reporting
- IT general controls (ITGC) assessment
- Segregation of duties documentation
- Audit trail and change management
- Section 404 compliance support
♿ ADA / Section 508
Americans with Disabilities Act and Section 508 of the Rehabilitation Act. Digital accessibility requirements for organizations providing services to the public or federal government. WCAG 2.1 Level AA is the standard benchmark.
- WCAG 2.1 AA conformance
- Screen reader compatibility
- Keyboard navigation support
- Accessible forms and documents
- Accessibility audit and remediation