- SOC 2 Type II
- Trust services criteria across security, availability, confidentiality, processing integrity and privacy. Evidence collection in Drata or Vanta-compatible format.
- GDPR
- Data flow diagrams, DPIA, ROPA, Article 30 records, sub-processor management, breach notification playbooks.
- HIPAA
- Technical, administrative and physical safeguards. PHI data flow, BAAs, access controls, audit logging.
- ISO 27001 / 27017 / 27018
- ISMS design, statement of applicability, risk treatment plan, control ownership. Cloud and PII-specific extensions.
- FedRAMP (Moderate)
- NIST 800-53 control mapping, continuous monitoring artifacts, OSCAL where applicable. US public sector and regulated supply chains.
- NIST CSF 2.0
- Identify, protect, detect, respond, recover, govern. General cyber risk posture regardless of formal certification.
- DPDP Act (India, 2023)
- Data principal rights, consent management, breach notification, data fiduciary obligations. Required for any product serving Indian users.
- PCI-DSS v4.0
- Where card data is in scope. Network segmentation, encryption, access control, quarterly scans. SAQ-D for full merchant environments.
- ISA / IEC 62443
- Industrial automation and control systems. Zones and conduits, security levels, SL-T and SL-A targets. Required for IIoT and OT.
- NIST 800-171 (CMMC L2/L3)
- Controlled unclassified information for defense supply chains. 110 control families, SSP and POA&M delivery.
- EU AI Act
- Risk-based AI obligations. High-risk system requirements, transparency duties, conformity assessments, post-market monitoring.
- SEBI / RBI (India fintech)
- Outsourcing guidelines, digital lending norms, cyber security framework. For fintech serving Indian customers.