Frameworks
Every compliance framework, mapped in one place
OneClickComply supports 240+ security and privacy standards, including ISO 27001, SOC 2, GDPR, NIS2, DORA, PCI DSS and HIPAA. Each one maps to a single set of controls, so evidence you collect once counts towards all of them.
- standards mapped
- 240+
- standards mapped
- countries covered
- 42
- countries covered
- regions
- 9
- regions
- set of controls
- 1
- set of controls
Frameworks directory
249 standards
UK10
- UK Data Protection Act 2018Law · United Kingdom
- Cyber EssentialsCertification · United Kingdom
- NCSC Cyber Assessment FrameworkFramework · United Kingdom
- NHS Data Security and Protection ToolkitFramework · United Kingdom
- Def Stan 05-138Standard · United Kingdom
- Def Stan 05-138 Level 3 (Expert)Standard · United Kingdom
- CAP 1850 Cyber Assessment Framework (CAF) for AviationGuidance · United Kingdom
- Def Stan 05-138 Level 0 (Basic)Standard · United Kingdom
- Def Stan 05-138 Level 1 (Foundational)Standard · United Kingdom
- Def Stan 05-138 Level 2 (Advanced)Standard · United Kingdom
EU23
- EU General Data Protection Regulation (GDPR)Regulation · EU
- EU AI ActRegulation · EU
- EU Cyber Resilience ActRegulation · EU
- NIS2 DirectiveLaw · EU
- Digital Operational Resilience Act (DORA)Regulation · EU
- Spain National Security Framework (ENS, Royal Decree 311/2022)Regulation · Spain
- Poland Act on the Protection of Personal DataLaw · Poland
- BSI C5:2020Standard · Germany
- Payment Services Directive 2 (PSD2)Law · EU
- Italian Personal Data Protection Code (Codice Privacy)Law · Italy
- BAIT (BaFin Supervisory Requirements for IT)Regulation · Germany
- EBA Guidelines on ICT and Security Risk Management (EBA/GL/2019/04)Guidance · EU
- BSI Standard 200-1Standard · Germany
- Irish Data Protection Act 2018Law · Ireland
- NIS2 Implementing Regulation (EU) 2024/2690Regulation · EU
- EU Cyber Resilience Act AnnexesRegulation · EU
- Spain Royal Decree 1720/2007Regulation · Spain
- Germany BDSG (Federal Data Protection Act)Law · Germany
- Belgian Data Protection Act (Act of 30 July 2018)Law · Belgium
- Austrian Data Protection Act (DSG)Law · Austria
- CCN-STIC 825: ENS and ISO 27001 Certifications GuideGuidance · Spain
- Greece Data Protection Law (Law 4624/2019)Law · Greece
- Hungarian Information Act (Act CXII of 2011)Law · Hungary
Europe5
US108
- SOC 2 (Trust Services Criteria)Standard · United States
- Sarbanes-Oxley ActLaw · United States
- NIST SP 800-53 Rev. 5Standard · United States
- NIST Cybersecurity Framework 2.0Framework · United States
- HIPAA Administrative Simplification RegulationsRegulation · United States
- FDA 21 CFR Part 11Regulation · United States
- HIPAA Security RuleRegulation · United States
- FERPA (Family Educational Rights and Privacy Act)Law · United States
- California Consumer Privacy Act (CCPA)Law · United States
- NIST AI Risk Management Framework 1.0Framework · United States
- CMMC 2.0 Level 2Certification · United States
- NIST SP 800-37 Rev. 2 (Risk Management Framework)Framework · United States
- DFARS 252.204-7012Regulation · United States
- NERC CIPStandard · United States
- Executive Order 14028: Improving the Nation's CybersecurityRegulation · United States
- Children's Online Privacy Protection Act (COPPA)Law · United States
- CMMC 2.0 Level 1Certification · United States
- CMMC 2.0 Level 1 Assessment ObjectivesFramework · United States
- FAR 52.204-21 Basic Safeguarding of Covered Contractor Information SystemsRegulation · United States
- NIST SP 800-207 Zero Trust ArchitectureGuidance · United States
- FedRAMP Rev. 5 High BaselineCertification · United States
- NIST SP 800-218 Secure Software Development Framework (SSDF)Framework · United States
- FBI CJIS Security Policy v6.0Standard · United States
- NIST Privacy FrameworkFramework · United States
- EU-U.S. Data Privacy Framework (DPF)Framework · United States
- Fair Credit Reporting Act (FCRA) and FACTALaw · United States
- NIST SP 800-82 Rev. 3Guidance · United States
- Colorado Privacy ActLaw · United States
- NIST SP 800-161 Rev. 1 Level 2 (Mission and Business Process)Guidance · United States
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500)Regulation · United States
- CMMC 2.0 Level 3Certification · United States
- FTC Act (Federal Trade Commission Act)Law · United States
- FedRAMP Rev. 5 Moderate BaselineCertification · United States
- NIST SP 800-171 Rev. 2Standard · United States
- Texas Data Privacy and Security ActLaw · United States
- FTC Safeguards Rule (GLBA, 16 CFR Part 314)Regulation · United States
- NIST SP 800-161 Rev. 1Guidance · United States
- Illinois Biometric Information Privacy Act (BIPA)Law · United States
- NIST AI 600-1 Generative AI ProfileGuidance · United States
- NIST SP 800-172Standard · United States
- NIST SP 800-171 Rev. 3Standard · United States
- Virginia Consumer Data Protection ActLaw · United States
- New York SHIELD ActLaw · United States
- NIST SP 800-39Guidance · United States
- Trusted Internet Connections (TIC) 3.0Framework · United States
- DoD Zero Trust Reference Architecture 2.0Guidance · United States
- DoD Zero Trust Strategy and Capability Execution RoadmapFramework · United States
- FAR 52.204-25 (Section 889)Regulation · United States
- GovRAMPCertification · United States
- IRS Publication 1075Guidance · United States
- Tennessee Information Protection ActLaw · United States
- Texas SB 2610 Cybersecurity Safe HarbourLaw · United States
- California Data Breach Notification Law (SB 1386)Law · United States
- Fair Information Practice PrinciplesGuidance · United States
- FedRAMP Rev. 5 Low BaselineCertification · United States
- NIST SP 800-171AGuidance · United States
- Oregon Consumer Privacy ActLaw · United States
- FINRA Cybersecurity RequirementsRegulation · United States
- Massachusetts 201 CMR 17.00Regulation · United States
- NAIC Insurance Data Security Model Law (MDL-668)Law · United States
- NISPOM (32 CFR Part 117)Regulation · United States
- NIST SP 800-53 Rev. 4Standard · United States
- Texas Business and Commerce Code Chapter 521Law · United States
- CISA Cross-Sector Cybersecurity Performance GoalsGuidance · United States
- Cybersecurity Capability Maturity Model (C2M2)Framework · United States
- NIST SP 800-66 Rev. 2 (HIPAA Security Rule Guide)Guidance · United States
- SPARTA (Space Attack Research and Tactic Analysis)Framework · United States
- CMS MARS-E 2.0Standard · United States
- Illinois Personal Information Protection ActLaw · United States
- FAR 52.204-27 Prohibition on a ByteDance Covered ApplicationRegulation · United States
- Nevada Consumer Health Data and Data Security Law (NRS 603A)Law · United States
- Oregon Consumer Information Protection Act (ORS 646A.600 to 646A.628)Law · United States
- SEC Cybersecurity Disclosure RuleRegulation · United States
- CISA Secure Software Development Attestation FormGuidance · United States
- Vermont Data Broker Law (Act 171 of 2018)Law · United States
- FedRAMP Tailored LI-SaaS (Rev. 5)Certification · United States
- NIST SP 800-171A Rev. 3Guidance · United States
- NIST SP 800-53B Moderate BaselineStandard · United States
- Alaska Personal Information Protection ActLaw · United States
- NIST SP 800-160 Vol. 2 Rev. 1Guidance · United States
- TX-RAMP Level 2Certification · United States
- California SB-327 IoT Security LawLaw · United States
- CERT Resilience Management Model (CERT-RMM) v1.2Framework · United States
- Illinois Identity Protection ActLaw · United States
- NIST SP 800-53B Privacy BaselineStandard · United States
- Texas SB 820 (School District Cybersecurity)Law · United States
- TX-RAMP Level 1Certification · United States
- Unclassified Naval Nuclear Propulsion Information (U-NNPI)Regulation · United States
- 45 CFR 155.260 (ACA Exchange Privacy and Security)Regulation · United States
- FCA Cyber Risk Management Rule (12 CFR Part 609)Regulation · United States
- GovRAMP CoreCertification · United States
- GovRAMP HighCertification · United States
- GovRAMP LowCertification · United States
- GovRAMP Low+Certification · United States
- GovRAMP ModerateCertification · United States
- Nevada Gaming Regulation 5.260 (Cybersecurity)Regulation · United States
- Nevada SB 220 (Online Privacy Opt-Out of Sale)Law · United States
- NIST SP 800-161 Rev. 1 C-SCRM BaselineGuidance · United States
- NIST SP 800-161 Rev. 1 Flow-Down ControlsGuidance · United States
- NIST SP 800-161 Rev. 1 Level 1 (Enterprise)Guidance · United States
- NIST SP 800-161 Rev. 1 Level 3 (Operational C-SCRM)Guidance · United States
- NIST SP 800-53B High BaselineStandard · United States
- NIST SP 800-53B Low BaselineStandard · United States
- NIST SP 800-82 Rev. 3 High OT OverlayGuidance · United States
- NIST SP 800-82 Rev. 3 Low OT OverlayGuidance · United States
- NIST SP 800-82 Rev. 3 Moderate OT Overlay BaselineGuidance · United States
- Texas DIR Security Control Standards Catalog v2.2Standard · United States
- TSA Security Directive 1580/82-2022-01: Rail Cybersecurity Mitigation Actions and TestingRegulation · United States
Canada4
Latin America & Caribbean7
- Colombia Data Protection Law (Law 1581 of 2012)Law · Colombia
- Chile Personal Data Protection Law (Law 21.719)Law · Chile
- Brazil LGPD (Lei Geral de Proteção de Dados)Law · Brazil
- Argentina AAIP Resolution 132/2018Regulation · Argentina
- Mexico Federal Law on the Protection of Personal Data Held by Private PartiesLaw · Mexico
- Bahamas Data Protection (Privacy of Personal Information) ActLaw · The Bahamas
- BMA Insurance Sector Operational Cyber Risk Management Code of ConductRegulation · Bermuda
Asia-Pacific30
- Australian Privacy Act 1988Law · Australia
- Australian Privacy PrinciplesLaw · Australia
- India Digital Personal Data Protection Act 2023Law · India
- APRA CPS 230 Operational Risk ManagementRegulation · Australia
- Essential EightFramework · Australia
- APRA CPS 234 Information SecurityRegulation · Australia
- Australian Information Security Manual (ISM)Framework · Australia
- Philippines Data Privacy Act of 2012Law · Philippines
- India SPDI Rules 2011Regulation · India
- China Personal Information Protection Law (PIPL)Law · China
- MAS Technology Risk Management GuidelinesGuidance · Singapore
- SEBI Cybersecurity and Cyber Resilience Framework (CSCRF)Regulation · India
- China Cybersecurity LawLaw · China
- China Data Security LawLaw · China
- Japan Act on the Protection of Personal Information (APPI)Law · Japan
- APEC Privacy FrameworkFramework · Asia-Pacific
- Malaysia Personal Data Protection Act 2010Law · Malaysia
- New Zealand Privacy Act 2020Law · New Zealand
- Hong Kong Personal Data (Privacy) OrdinanceLaw · Hong Kong
- Singapore Personal Data Protection Act (PDPA)Law · Singapore
- ISMAP (Japan)Certification · Japan
- South Korea Personal Information Protection Act (PIPA)Law · South Korea
- New Zealand Information Security Manual (NZISM) v3.6Standard · New Zealand
- Taiwan Personal Data Protection ActLaw · Taiwan
- MAS Notice on Cyber HygieneRegulation · Singapore
- Health Information Security Framework (HISF) for Medium to Large Organisations and HospitalsFramework · New Zealand
- Health Information Security Framework Guidance for SuppliersFramework · New Zealand
- China Decision on Strengthening Network Information ProtectionLaw · China
- Code of Practice: Securing the Internet of Things for ConsumersGuidance · Australia
- Health Information Security Framework Guidance for Micro to Small OrganisationsFramework · New Zealand
Middle East & Africa14
- NCA Essential Cybersecurity Controls (ECC-1:2018)Regulation · Saudi Arabia
- SAMA Cyber Security FrameworkFramework · Saudi Arabia
- South Africa POPIA (Protection of Personal Information Act)Law · South Africa
- Saudi Arabia Personal Data Protection Law (PDPL)Law · Saudi Arabia
- NCA Critical Systems Cybersecurity Controls (CSCC-1:2019)Regulation · Saudi Arabia
- Saudi Arabia Operational Technology Cybersecurity Controls (OTCC-1:2022)Regulation · Saudi Arabia
- Kenya Data Protection Act 2019Law · Kenya
- Qatar Personal Data Privacy Protection LawLaw · Qatar
- Nigeria Data Protection Regulation (NDPR) 2019Regulation · Nigeria
- Israel Privacy Protection LawLaw · Israel
- Saudi Aramco Third Party Cybersecurity Standard (SACS-002)Standard · Saudi Arabia
- Israel Cyber Defense Methodology for an Organization (Version 1.0)Framework · Israel
- NCA Cybersecurity Guidelines for Internet of Things (CGIoT-1:2024)Guidance · Saudi Arabia
- UAE National Information Assurance FrameworkFramework · United Arab Emirates
Global48
- ISO 9001:2015Standard · Global
- ISO/IEC 27001:2022Certification · Global
- OWASP Top 10:2025Guidance · Global
- PCI DSS v4.0.1Standard · Global
- MITRE ATT&CK v16Framework · Global
- ISO 31000:2018 Risk Management GuidelinesGuidance · Global
- ISO/IEC 42001:2023Standard · Global
- ISO 22301Standard · Global
- COSO Internal Control Integrated Framework (2013)Framework · Global
- ISO/IEC 27701:2025Standard · Global
- ISO/IEC 27002:2022Standard · Global
- CIS Controls v8.1Framework · Global
- COBIT 2019Framework · Global
- ISO/IEC 27017:2015Standard · Global
- ISO/SAE 21434Standard · Global
- ISO/IEC 27018:2025Standard · Global
- TISAX (VDA ISA 6)Standard · Global
- IEC/ISO 31010:2009 Risk Assessment TechniquesStandard · Global
- CSA Cloud Controls Matrix (CCM) v4.1Framework · Global
- CIS Critical Security Controls v8.1 Implementation Group 2 (IG2)Framework · Global
- IEC 62443-4-1:2018Standard · Global
- IEC 62443-4-2:2019Standard · Global
- Shared Assessments SIG QuestionnaireFramework · Global
- UN Regulation No. 155 (Cyber Security and CSMS)Regulation · Global
- PCI DSS SAQ AStandard · Global
- CIS Controls v8.1 Implementation Group 1 (IG1)Framework · Global
- CIS Controls v8.1 Implementation Group 3 (IG3)Framework · Global
- IEC 62443-3-3Standard · Global
- ISO/IEC 29100:2024Standard · Global
- SWIFT Customer Security Controls Framework (CSCF) v2025Framework · Global
- IEC 62443-2-1:2024Standard · Global
- IMO Guidelines on Maritime Cyber Risk ManagementGuidance · Global
- OECD Privacy GuidelinesGuidance · Global
- PCI DSS SAQ A-EPStandard · Global
- UL 2900-1 Software Cybersecurity for Network-Connectable ProductsStandard · Global
- PCI DSS v4.0.1 SAQ CStandard · Global
- Cyber Resilience Capability Maturity Model (CR-CMM)Framework · Global
- PCI DSS SAQ C-VTStandard · Global
- PCI DSS SAQ P2PEStandard · Global
- PCI DSS v4.0.1 SAQ BStandard · Global
- PCI DSS v4.0.1 SAQ B-IPStandard · Global
- PCI DSS SAQ D for Service ProvidersStandard · Global
- IEC TR 60601-4-5:2021Guidance · Global
- PCI DSS v4.0.1 SAQ D for MerchantsStandard · Global
- MPA Content Security Best PracticesFramework · Global
- CSA IoT Security Controls Framework v2Framework · Global
- UL 2900-2-2Standard · Global
- AICPA Privacy Management FrameworkFramework · Global
Standards FAQs
OneClickComply supports 240+ security and privacy standards, including ISO 27001, SOC 2, GDPR, NIS2, DORA, PCI DSS and HIPAA. They cover laws, regulations, industry standards and frameworks from the UK, EU, US, Asia-Pacific and beyond. Search the directory or filter it by country, region or type to find yours.
Laws and regulations are set by governments and regulators, and organisations in their scope must comply. Standards and frameworks, such as ISO 27001 or NIST CSF, come from standards bodies and industry groups, and are usually adopted voluntarily or because customers ask for them. Each standard's page shows its type and whether it is mandatory, contractual or voluntary.
Yes. OneClickComply maps every standard to one shared set of controls, so a control you put in place and evidence once counts towards every standard it applies to. Adding a second or third standard means closing the gaps, not starting again.
Start with the laws of the countries you operate in and the sectors you serve, then add the standards your customers ask for, such as ISO 27001 or SOC 2. Choose your country in the directory to see its own standards alongside international ones. Each standard's page explains who needs it.
Tell us which standard you need and we'll map it. It is mapped to the same set of controls as everything else, so the evidence you already hold counts towards it.
One set of controls. Every standard.
Collect evidence once from 13,000+ tools, fix what fails with OneClickFix, and watch your progress against every framework at the same time.