Policy Packages for Every Framework

The authoritative United States framework for managing AI risk, organized around Govern, Map, Measure, and Manage, extended by the Generative AI Profile.

Policy coverage for the top security risks in large language model and generative AI applications, from the OWASP GenAI Security Project.

The European Union regulation on artificial intelligence, adopted 2024, with obligations across risk management, data governance, transparency, human oversight, and quality management.

The first certifiable international standard for an AI management system, pairing management system clauses with Annex A reference controls for responsible AI.

The authoritative control catalog for federal agencies and FedRAMP-authorized systems. Covers all 20 control families. Required for any system operating under FISMA.

Mandatory for any cloud service provider selling to federal agencies. Based on NIST 800-53 with additional FedRAMP-specific controls across Low, Moderate, and High baselines.

110 security requirements across 14 families for government contractors handling CUI. Required for any nonfederal organization that stores, processes, or transmits CUI under federal contracts.

Three-tiered cybersecurity maturity model required for DoD contractors. Level 2 maps directly to NIST 800-171 and is the certification standard for the defense industrial base supply chain.

Mandatory for all federal agencies and contractors. Requires documented information security programs aligned with NIST Risk Management Framework across Low, Moderate, and High impact systems.

Mandates NIST 800-171 compliance and 72-hour cyber incident reporting for all DoD supply chain contractors. Clause 252.204-7012 applies to any organization with a DoD contract touching CUI.

Mandatory basic safeguarding requirements for all federal contractors and subcontractors that process, store, or transmit federal contract information (FCI). Applies to any company with a federal contract.

CISA BODs establish mandatory baseline security practices for federal agencies. Coverage includes BOD 18-01 (HTTPS/email), BOD 19-02 (vulnerability remediation), BOD 22-01 (known exploited vulnerabilities), and BOD 23-01 (asset visibility).

OMB Circular A-130 establishes policy for managing federal information as a strategic resource. A-123 governs management accountability and internal controls. Together they define governance requirements for all federal information systems.

Security authorization framework for cloud service providers working with state and local government agencies. Based on NIST 800-53 controls scaled for state-level procurement requirements.

Industry-agnostic, prioritized baseline of 18 critical control families organized into Implementation Groups (IG1, IG2, IG3). Widely adopted across public and private sectors and mapped to NIST 800-53 and NIST CSF for concrete, actionable hardening guidance.

The May 2024 standard for protecting Controlled Unclassified Information in nonfederal systems, with 17 requirement families for commercial CUI handlers and organizations outside the CMMC path.

Enhanced security requirements for protecting Controlled Unclassified Information in high value programs, aligned to CMMC Level 3 and advanced persistent threat defense.

Required for all covered entities and business associates. The NIST 800-66 implementation guidance provides the technical standard for satisfying the HIPAA Security Rule's administrative, physical, and technical safeguard requirements.

Extends HIPAA obligations to business associates and significantly increases breach notification requirements and penalty tiers. Required for any organization in the healthcare supply chain handling ePHI.

Required for any organization that accepts, processes, stores, or transmits payment card data. PCI DSS v4.0 introduced customized implementation options and enhanced authentication requirements effective March 2025.

Required by enterprise customers of SaaS and technology companies. Covers Security, Availability, Processing Integrity, Confidentiality, and Privacy trust service criteria. A Type II report covers a minimum 6-month observation period.

Mandatory for all US public companies. IT General Controls (ITGCs) around access management, change management, and computer operations directly affect the reliability of financial reporting systems.

Requires financial institutions to implement a written information security program. The 2023 updated Safeguards Rule significantly expanded technical requirements including encryption, MFA, and incident response timelines.

The international standard for ISMS certification. The 2022 revision reorganized Annex A controls into four themes. Certification is recognized globally and increasingly required for government contracts outside the US.

Applies to any organization processing personal data of EU residents regardless of where the organization is located. Penalties up to 20 million euros or 4% of global annual revenue.

Applies to businesses meeting revenue or data volume thresholds that collect personal information from California residents. The CPRA created the California Privacy Protection Agency with dedicated enforcement authority.

The 2024 update added the Govern function as a sixth core function, making organizational governance and accountability explicit requirements. Applicable across sectors with no industry restriction.

Student education records privacy for K-12 schools, higher education, and any organization subject to FERPA: directory information rules, parent and eligible student access, disclosure limits, and annual notification.

The PIMS extension to an ISO 27001 ISMS, adding privacy controls for PII controllers and processors to demonstrate GDPR and privacy accountability through certification.

A voluntary framework for managing privacy risk across the data lifecycle, organized around Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P.

The authoritative federal guide for securing industrial control systems, SCADA, distributed control systems, and other OT environments. Critical for energy, utilities, manufacturing, and critical infrastructure operators.

Mandatory for all bulk electric system owners, operators, and users. CIP standards cover physical security, cyber security, personnel, and supply chain risk for high, medium, and low impact BES cyber systems.

Mandatory configuration and hardening standards for all DoD information systems. STIGs provide prescriptive technical requirements for operating systems, network devices, applications, and cloud environments across the defense enterprise.