Every control, and what proves it

29 frameworks, 4198 requirements. Each page lists the artefacts auditors commonly ask for, tagged by whether a system already holds them or a person produces them on a schedule.

Information security

ISO/IEC 27001:2022123 requirements · 586 artefacts · 30 with a quarter or more already held by a system SOC 2 (2017 Trust Services Criteria)61 criteria · 236 artefacts · 29 with a quarter or more already held by a system ISO/IEC 27002:202293 controls · 550 artefacts · 30 with a quarter or more already held by a system NIST CSF 2.0106 subcategories · 533 artefacts · 19 with a quarter or more already held by a system CIS Controls v8.1153 safeguards · 460 artefacts · 108 with a quarter or more already held by a system

Cloud and government

NIST SP 800-53 Rev 51014 controls and enhancements · 8393 artefacts · 54 with a quarter or more already held by a system NIST SP 800-171 Rev 397 requirements · 280 artefacts · 63 with a quarter or more already held by a system CMMC 2.0110 requirements · 334 artefacts · 77 with a quarter or more already held by a system FedRAMP Moderate (NIST SP 800-53 Rev 5 baseline)323 controls and enhancements · 1319 artefacts · 136 with a quarter or more already held by a system FedRAMP High (NIST SP 800-53 Rev 5 baseline)410 controls and enhancements · 1438 artefacts · 164 with a quarter or more already held by a system CSA CCM v4.1207 control objectives · 914 artefacts · 98 with a quarter or more already held by a system BSI C5 (121-criteria catalogue)121 criteria · 487 artefacts · 62 with a quarter or more already held by a system Azure Security Benchmark v3 (renamed Microsoft cloud security benchmark)85 controls · 327 artefacts · 58 with a quarter or more already held by a system AWS Well-Architected Security Pillar63 best practices · 247 artefacts · 42 with a quarter or more already held by a system

Payments

PCI DSS v4.0.1280 requirements · 1198 artefacts · 180 with a quarter or more already held by a system

Privacy and health

HIPAA Security Rule67 standards and specifications · 333 artefacts · 32 with a quarter or more already held by a system ISO/IEC 27701:2025108 requirements · 402 artefacts · 19 with a quarter or more already held by a system GDPR41 articles · 200 artefacts · 2 with a quarter or more already held by a system CCPA/CPRA57 sections · 183 artefacts · 18 with a quarter or more already held by a system

Resilience and operational risk

ISO 22301:201957 requirements · 205 artefacts · 11 with a quarter or more already held by a system DORA (Regulation (EU) 2022/2554)24 articles · 97 artefacts · 5 with a quarter or more already held by a system APRA CPS 23424 paragraphs · 120 artefacts · 1 with a quarter or more already held by a system APRA CPS 23044 paragraphs · 145 artefacts · 10 with a quarter or more already held by a system NIST SP 800-161 Rev 1 (supply chain)191 controls · 593 artefacts · 29 with a quarter or more already held by a system

Baselines

UK Cyber Essentials36 requirements · 102 artefacts · 30 with a quarter or more already held by a system ACSC Essential Eight Maturity Model (November 2023)152 requirements · 304 artefacts · 101 with a quarter or more already held by a system ASD Strategies to Mitigate Cyber Security Incidents37 strategies · 148 artefacts · 33 with a quarter or more already held by a system

Software and AI

NIST SP 800-218 (SSDF)42 tasks · 113 artefacts · 15 with a quarter or more already held by a system NIST AI RMF 1.072 subcategories · 290 artefacts · 9 with a quarter or more already held by a system