Cyber, critical infrastructure & AI standards — all in one place.
The latest standards, laws and regulations, with curated metadata, mapped controls and expert guidance from 6clicks. Built for GRC, compliance and security teams.
In this category · 24 items
OWASP ASVS — OWASP Application Security Verification Standard
The OWASP Application Security Verification Standard (ASVS) is an open standard for testing and verifying the security of web applications. It provides developers with a comprehensive list of requirements for secure development and helps establish confidence in application security.
- Issuer
- OWASP Foundation
- Version
- 4.0.2
- Updated
- May 2025
CMMC — Cybersecurity Maturity Model Certification
The Cybersecurity Maturity Model Certification (CMMC) Assessment Guide defines how organizations are evaluated for compliance with cybersecurity requirements when working with the U.S. Department of Defense. It outlines assessment methods, evidence expectations, and control validation aligned with standards like NIST SP 800-171. The guide ensures consistent and rigorous verification of an organization’s ability to protect sensitive information.
- Issuer
- US Government
- Jurisdiction
- USA
- Version
- 2.13
SOC2 — SOC2 Trusted Services Criteria
SOC 2 is a framework for managing and reporting on controls at service organizations relevant to security, availability, processing integrity, confidentiality, and privacy. It aims to provide detailed information and assurance to stakeholders about how these controls are implemented to protect user data.
- Issuer
- American Institute of Certified Public Accountants (AICPA)
- Jurisdiction
- USA
- Updated
- Sep 2022
FSSCP — The Financial Services Sector Cybersecurity Profile
The Financial Services Sector Cybersecurity Profile is a scalable and extensible assessment tool designed to help financial institutions manage cyber risks and demonstrate regulatory compliance. It is based on the NIST Cybersecurity Framework and offers a tailored approach to streamline cybersecurity assessments globally.
- Issuer
- Financial Services Sector Coordinating Council (FSSCC)
- Jurisdiction
- Global
SMB1001 — SMB1001 Cybersecurity Standard
The SMB1001 Cybersecurity Standard provides small and medium-sized businesses, including law firms, with a clear and achievable framework to enhance their cybersecurity defenses and demonstrate due diligence. It aims to help practitioners protect client confidentiality, reduce cyber risks, and meet stakeholder requirements.
- Issuer
- Dynamic Standards International (DSI)
- Jurisdiction
- Australia
- Version
- 2026
QCF — Qatar Cybersecurity Framework
The Qatar Cybersecurity Framework (QCF) provides structured guidelines to help organizations manage and strengthen their cybersecurity practices across governance, risk, protection, detection, response, and recovery. It promotes a proactive, coordinated approach to mitigating cyber threats while enhancing national and organizational resilience.
- Issuer
- Qatar National Cyber Security Committee (NCSC)
- Jurisdiction
- Qatar
NSW Cyber Security Policy
The NSW Cyber Security Policy outlines mandatory requirements that all NSW Government agencies must follow to ensure the effective management of cyber security risks to government information and systems. It mandates annual reporting by agencies and includes policy directives related to incident management, risk assessment, and compliance.
- Issuer
- Cyber Security NSW
- Jurisdiction
- New South Wales, Australia
AESCSF v2 Core — Australian Energy Sector Cyber Security Framework
The Australian Energy Sector Cyber Security Framework (AESCSF) provides a structured approach for managing cybersecurity risks specific to the energy sector. Version 2 introduces updates and refinements to address evolving threats and ensure resilience.
- Issuer
- Australian Energy Market Operator (AEMO)
- Jurisdiction
- Australia
- Version
- 2.0
- Updated
- Jan 2023
Cyber Essentials Mark — CSA Cybersecurity Certification: Cyber Essentials Mark
The Cyber Essentials (2025) certification is a cybersecurity certification scheme developed by the Cyber Security Agency (CSA) of Singapore. It provides a framework for organisations to enhance their cybersecurity posture, covering areas like classical cybersecurity, cloud security, OT security, and AI security.
- Issuer
- Cyber Security Agency of Singapore (CSA)
- Jurisdiction
- Singapore
- Version
- 04-2025 (Second edition)
- Updated
- Apr 2026
BSI IT-Grundschutz-Compendium Edition 2022
The BSI IT-Grundschutz-Compendium Edition 2022 is a comprehensive cybersecurity guideline published by the German Federal Office for Information Security (BSI). It provides a structured methodology for implementing information security in organizations based on standardized modules and best practices.
- Issuer
- Federal Office for Information Security (BSI)
- Jurisdiction
- Germany
- Version
- 2022
- Updated
- Jan 2023
ITSP.10.171 — Protecting Specified Information in Non-Government of Canada Systems and Organizations
ITSP.10.171 sets out security requirements for protecting 'specified information' when it resides in non-Government of Canada systems or organizations. It aligns with NIST standards but adapts them to the Canadian regulatory environment.
- Issuer
- Canadian Centre for Cyber Security
- Jurisdiction
- Canada
- Version
- First release
- Updated
- Oct 2025
Baseline Cyber Security Controls for Small and Medium Organizations
The Baseline Cyber Security Controls for Small and Medium Organizations provides guidance from the Canadian Centre for Cyber Security to improve the resilience of smaller organizations through focused cybersecurity measures. It applies the 80/20 rule, aiming to achieve significant cybersecurity benefits with minimal effort.
- Issuer
- Canadian Centre for Cyber Security
- Jurisdiction
- Canada
- Version
- 1.2
SCF — Secure Controls Framework
The Secure Controls Framework (SCF) is a comprehensive, free cybersecurity and data privacy metaframework designed to simplify compliance and build secure, resilient organizations. It unifies control sets to simultaneously meet compliance requirements across multiple laws, regulations, and frameworks.
- Issuer
- Secure Controls Framework (SCF) Council
- Version
- 2023.2
Cyber Essentials v3.2 — Cyber Essentials Requirements for IT Infrastructure
Cyber Essentials is a UK government-backed scheme focused on protecting IT infrastructure from common cyber threats. Version 3.2 outlines updated security controls and practices.
- Issuer
- UK National Cyber Security Centre (NCSC)
- Jurisdiction
- United Kingdom
- Version
- 3.2
ADHICS — Abu Dhabi Healthcare Information and Cyber Security Standard
The AAMEN programme ensures that all healthcare facilities in Abu Dhabi comply with information security and data privacy standards to safeguard patient data. It incorporates the Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS) and aims to enhance cybersecurity governance, resilience, and innovation in the healthcare sector.
- Issuer
- Department of Health Abu Dhabi
- Jurisdiction
- Abu Dhabi, United Arab Emirates
- Version
- 2
- Updated
- May 2026
UAE IA V2 — UAE Information Assurance Standard Version 2
The UAE Information Assurance Standard Version 2 (UAE IA V2) is a national cybersecurity framework issued by the UAE Cyber Security Council in 2025. It builds upon the previous version with updated controls and integrations to address modern technologies, such as AI/ML, IoT, cloud, and post-quantum cryptography.
- Issuer
- UAE Cyber Security Council
- Jurisdiction
- United Arab Emirates
- Version
- 2.0
- Updated
- Oct 2025
VPDSS 2.0 — Victorian Protective Data Security Standards V2.0
The Victorian Protective Data Security Standards (VPDSS) establish 12 high-level mandatory requirements for the protection of public sector information in Victoria, Australia. These requirements cover governance, information, personnel, ICT, and physical security, focusing on a risk-managed approach tailored to the Victorian government context.
- Issuer
- Office of the Victorian Information Commissioner (OVIC)
- Jurisdiction
- Victoria, Australia
- Version
- 2.0
- Updated
- Oct 2019
NIST SP 800-39 — NIST Special Publication 800-39 - Managing Information Security Risk: Organization, Mission, and Information System View
NIST SP 800-39 provides guidance for developing an organization-wide program to manage information security risk. It introduces a structured yet flexible framework for assessing, responding to, and monitoring risks associated with federal information systems.
- Issuer
- National Institute of Standards and Technology (NIST)
- Jurisdiction
- United States
- Updated
- Mar 2011
NIST SP 800-171A Rev. 3 — NIST Special Publication 800-171A Rev. 3 - Assessing Security Requirements for Controlled Unclassified Information
This publication provides a methodology and assessment procedures for evaluating security requirements associated with the protection of Controlled Unclassified Information (CUI). It supports compliance with NIST SP 800-171 in nonfederal systems and organizations.
- Issuer
- National Institute of Standards and Technology (NIST)
- Jurisdiction
- United States
- Version
- Revision 3
- Updated
- Nov 2023
NIST SP 800-161 Rev. 1 — NIST Special Publication 800-161 Rev. 1 - Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations
This publication provides guidance on identifying, assessing, and mitigating cybersecurity risks throughout the supply chain. It integrates Cybersecurity Supply Chain Risk Management (C-SCRM) practices into organizational risk management processes.
- Issuer
- National Institute of Standards and Technology (NIST)
- Jurisdiction
- United States
- Version
- Rev. 1, Update 1
NIST CSF 2.0 — NIST Cybersecurity Framework 2.0
The NIST Cybersecurity Framework 2.0 is a comprehensive framework to help organizations manage and reduce cybersecurity risks. It provides guidelines, tools, and resources for improving cybersecurity practices across diverse sectors.
- Issuer
- National Institute of Standards and Technology (NIST)
- Jurisdiction
- United States
- Version
- 2.0
- Updated
- Feb 2026
CPG 234 — CPG 234 Information Security
This standard provides information security guidance for Australian financial institutions regulated by APRA. It aims to ensure operational resilience and protect against information security threats.
- Issuer
- Australian Prudential Regulation Authority (APRA)
- Jurisdiction
- Australia
- Version
- June 2019
- Updated
- Jun 2019
ISO/IEC 27001:2013 — ISO/IEC 27001:2013 - Information technology — Security techniques — Information security management systems — Requirements
ISO/IEC 27001:2013 specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS). It also includes guidelines for assessing and addressing information security risks in organizations.
- Issuer
- ISO/IEC
- Version
- 2013
ISO/IEC 27001:2022 — ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements
ISO/IEC 27001:2022 is an international standard defining requirements for an information security management system (ISMS). It helps organizations establish, implement, maintain, and continually improve their information security processes to manage data-related risks.
- Issuer
- ISO/IEC
- Version
- 2022
Ready to operationalize these standards?
The 6clicks platform maps these regulations to controls, evidence and risks — automatically.