Compliance frameworks
The standards and regulations we prepare clients for, grouped by where they apply. We prepare you for the audit or the regulator's review. The assessor (a certification body, CPA firm or PCI QSA, depending on the framework) carries it out and decides the result.
Frameworks by region
International
- ISO/IEC 27001:2022Information security management
- ISO/IEC 27701:2025 and ISO/IEC 42001:2023Privacy and AI management systems
- PCI DSS v4.0.1Merchants, and service providers that store, process or transmit card data or can affect its security
- NIST CSF 2.0 and CIS ControlsProgramme baselines and maturity
- ISO 22301:2019Business continuity
Europe and UK
- GDPR and UK GDPRRecords, DPIAs, processor contracts
- NIS2Essential and important entities
- DORAFinancial entities, and their ICT providers through contract terms or directly if designated critical
- Cyber EssentialsNCSC scheme, required for some UK government contracts
Americas
- SOC 2 Type I and Type IIAICPA Trust Services Criteria
- HIPAA Security RuleCovered entities and their business associates
- NIST SP 800-171 and the CMMC ProgramUS defence supply chain
- CCPA and CPRA, PIPEDA, LGPDPrivacy in the US, Canada and Brazil
Middle East
- Saudi NCA ECC-2:2024Essential Cybersecurity Controls
- Saudi NCA Cloud Cybersecurity Controls (CCC)Cloud and SaaS providers serving government and critical infrastructure
- SAMA Cyber Security FrameworkSaudi financial sector, and its suppliers through third-party requirements
- UAE Information Assurance Standard v2.1Issued by the UAE Cyber Security Council in 2025
- DESC Information Security Regulation (ISR)Dubai government entities and, by contract, their suppliers
- Qatar NIANational Information Assurance standard
- Saudi PDPL and UAE PDPLPersonal data protection
India
- Digital Personal Data Protection Act, 2023Consent, notices and breach reporting under the DPDP Rules, 2025, phased in to May 2027
- CERT-In DirectionsSix-hour incident reporting, log retention
- SEBI CSCRFRegulated entities in the securities market
- RBI cybersecurity and technology risk directionsBanks, NBFCs and payment operators
- IRDAI Information and Cyber Security GuidelinesInsurers and intermediaries
Asia-Pacific
- MAS TRM GuidelinesSingapore financial institutions
- Singapore PDPAPersonal data protection
- Australian Essential EightASD's ACSC mitigation strategies
What each service gives you as evidence
Different regulations often ask for similar evidence. Your own obligations depend on your sector and licence, so check the exact clauses with your compliance lead or counsel.
| Requirement | Where it appears | What we provide |
|---|---|---|
| Regular security testing | ISO 27001 A.8.8 and A.8.29, PCI DSS v4.0.1 11.3 and 11.4, NCA ECC-2:2024 2-10 and 2-11, DORA Art. 24 and 25, SAMA CSF, MAS TRM | Penetration test report, retest letter, vulnerability scan history |
| Risk assessment | ISO 27001 clause 6.1, NIS2 Art. 21, SOC 2 CC3, HIPAA 164.308(a)(1) | Risk register and method, treatment plan, Statement of Applicability |
| Supplier security | DORA Art. 28 to 30, NIS2 Art. 21(2)(d), ISO 27001 A.5.19 to A.5.22, SOC 2 CC9.2 | Supplier tiering, supplier assessments, DORA register of information |
| Incident response and reporting | CERT-In six-hour reporting, DPDP Rules breach notice (from May 2027), NIS2 Art. 23, DORA Art. 19 | Incident response plan, reporting playbook, tabletop exercise record |
| Governance and oversight | NIS2 Art. 20, DORA Art. 5, SEBI CSCRF, NCA ECC-2:2024 1-1 to 1-3 | Policies, board reporting, roles and responsibilities, vCISO minutes |
| Personal data | GDPR Art. 30 and 35, DPDP Act, Saudi and UAE PDPL | Records of processing, DPIAs, notices and consent records |
Several frameworks, one set of controls
Take a SaaS company selling to banks in Saudi Arabia, the EU and the US. Saudi banks pass on SAMA's third-party requirements and may also expect NCA's Cloud Cybersecurity Controls. EU banks have to put DORA terms into the contract. US buyers usually want a SOC 2 report, and many ask for ISO 27001 too. If the product stores, processes or transmits card data, or can affect its security, PCI DSS applies to it as a service provider. Run as separate projects, that is up to six gap assessments and six evidence folders.
We write one control set, map it to each framework, and collect evidence so it can be reused across them. When a new framework comes up, we add the extra controls to the mapping.