Compliance standards for Government
Curated standards, laws and regulations relevant to Government organizations. Updated continuously, with mapped controls and expert guidance from 6clicks.
All Government content · 49 items
Work Health and Safety Regulations 2011
The Work Health and Safety Regulations 2011 establish detailed requirements for workplace health and safety in compliance with the Work Health and Safety Act 2011. They cover topics such as risk management, workplace conditions, hazardous materials, emergency plans, and licensing for high-risk activities.
Australian Government • Australia • vNo. 15, 1 July 2020
Work Health and Safety Act 2011
The Work Health and Safety Act 2011 is Australian legislation that establishes a framework to ensure workplace safety and health across various industries and occupations. It defines responsibilities for employers, workers, and other parties in maintaining safe conditions and managing risks related to work-related activities.
Australian Government • Australia • vNo. 9, 1 July 2018
Criminal Code Act 1995
The Criminal Code Act 1995 is an Australian federal law that establishes the legal framework for addressing criminal offenses. It outlines principles of criminal responsibility, specific offenses such as terrorism and espionage, and provisions for external and corporate liabilities.
Attorney-General's Department • Australia • vNo. 137, 17 February 2021
Copyright Act 1968
The Copyright Act 1968 is a foundational law in Australia governing copyrights and intellectual property rights in literary, artistic, dramatic, and musical works, as well as sound recordings, broadcasts, and published editions. It defines the rights and protections for creators and sets out provisions for infringement, fair dealing, and public access in specific scenarios such as education and disabilities.
Australian Government • Australia • vNo. 59, 18 December 2020
Child Support (Registration and Collection) Act 1988
The Child Support (Registration and Collection) Act 1988 sets the legal framework for registering and collecting child maintenance liabilities in Australia. It outlines processes for enforcing payments, managing registrable liabilities, and utilizing computer programs for certain decisions.
Australian Government • Australia • vNo. 61, 17 November 2016
BCI Act — Building and Construction Industry (Improving Productivity) Act 2016
The Building and Construction Industry (Improving Productivity) Act 2016 establishes a regulatory framework aimed at improving productivity and accountability within the building and construction sector in Australia. It provides for the creation of the Australian Building and Construction Commission and outlines rules governing industrial actions, security of payments, and compliance with workplace safety regulations.
Australian Government • Australia • vNo. 2, 17 February 2017
NIST SP 800-172 — Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171
NIST SP 800-172 elaborates enhanced security requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems and organizations. It aims to mitigate risks posed by Advanced Persistent Threats (APT) through a defense-in-depth approach, building on the foundational requirements in NIST SP 800-171.
National Institute of Standards and Technology (NIST) • United States
Spam Act 2003
The Spam Act 2003 is an Australian law designed to regulate the sending of commercial electronic messages to ensure compliance with consent, sender identification, and unsubscribe requirements. It aims to prevent unsolicited messages and address harvesting practices.
Australian Government • Australia • vNo. 10, 10 March 2016
Dubai ISR — Dubai Government Information Security Regulation
The Dubai Government Information Security Regulation (ISR) provides standards to ensure the continuity of critical business processes and minimize information security risks for Dubai Government Entities. It defines minimum requirements for information security controls and aims to maintain confidentiality, integrity, and availability of government information.
Dubai Government • Dubai • v3
Do Not Call Register Act 2006
The Do Not Call Register Act 2006 establishes a framework to prevent unsolicited telemarketing calls and faxes to individuals and organizations who register their numbers on the Do Not Call Register. It includes rules for telemarketers and penalties for violations.
Australian Government • Australia • vNo. 15, 12 December 2019
DSPF — Defence Security Principles Framework
The Defence Security Principles Framework (DSPF) is the Australian Department of Defence's principles-based security framework that provides governance, security principles, and controls to help Defence personnel manage risks and protect Defence people, information, assets, and operations in alignment with the PSPF.
Australian Government • Australian • v2 July 2018
Disability Discrimination Act 1992
The Disability Discrimination Act 1992 is an Australian law prohibiting discrimination based on disability across various areas, including employment, education, access to services, and public spaces. It aims to promote equal opportunity and eliminate unjustifiable hardship for individuals with disabilities.
Australian Government • Australia • vNo. 31, 1 July 2016
Charter of the United Nations Act 1945
The Charter of the United Nations Act 1945 provides a legal framework for implementing United Nations Security Council Resolutions in Australia. It regulates the application of sanctions, the listing and proscription of individuals or entities, and addresses offenses related to UN sanctions.
Australian Government • Australia • vNo. 14, 1 July 2016
Autonomous Sanctions Act 2011
The Autonomous Sanctions Act 2011 establishes the legal framework for imposing sanctions by the Australian Government as part of its foreign policy objectives. It includes provisions for sanction regulations, offences, and enforcement mechanisms.
Australian Government • Australia • v26 May 2011
FedRAMP Controls — FedRAMP Security Controls Baseline rev 5
The FedRAMP Security Controls Baseline is a standardized set of cloud security requirements based on NIST SP 800-53 that defines the minimum security controls cloud service providers must implement to protect federal data and achieve FedRAMP authorization.
US Government • USA • vrev 5
ASIC Act — Australian Securities and Investments Commission Act 2001
This Act establishes the legal framework for the operation of the Australian Securities and Investments Commission (ASIC), which is responsible for regulating company, financial services, and consumer protection laws in Australia. It outlines ASIC's powers, functions, and responsibilities while detailing provisions for consumer protection and fair competition in financial services industries.
Australian Government • Australia • vNo. 91, 1 July 2023
WA Cyber Security Policy — Western Australian Government Cyber Security Policy
The 2024 WA Government Cyber Security Policy outlines the baseline requirements for cyber security practices within Western Australian Government entities. It aims to reduce cyber security risks through a comprehensive and systematic approach to safeguarding digital information, information systems, and assets.
Department of the Premier and Cabinet - Office of Digital Government • Western Australia • v2024
Anti-Discrimination Act 1991 (Qld) — Queensland Anti-Discrimination Act 1991
The Anti-Discrimination Act 1991 is legislation enacted by the Queensland Government to promote equality of opportunity, prohibit discrimination, and encourage tolerance in the state of Queensland, Australia. It covers areas such as work, education, and the provision of goods and services.
Queensland Government • Queensland
NCCP Regulations — National Consumer Credit Protection Regulations 2010
This regulation provides detailed requirements under the National Consumer Credit Protection Act 2009 to govern the licensing, responsible lending, credit contracts, and compliance monitoring for entities providing credit services in Australia. It aims to ensure transparency and protection for consumers in financial and credit transactions.
Australian Government • Australia • v2021-12
SIS Act — Superannuation Industry (Supervision) Act 1993
The Superannuation Industry (Supervision) Act 1993 establishes the regulatory framework for superannuation funds in Australia. It defines compliance standards for trustees, funds, and associated entities, aiming to ensure proper administration and protection of member benefits.
Australian Government • Australia • vNo. 78, 1993
NCCP Act 2009 — National Consumer Credit Protection Act 2009
The National Consumer Credit Protection Act 2009 is an Australian law that regulates the provision of consumer credit and financial services in the country. It outlines licensing requirements for entities engaged in credit activities and includes protections for consumers against unsuitable credit agreements.
Australian Government • Australia • vNo. 134
LGOIMA — Local Government Official Information and Meetings Act 1987 - New Zealand
The Local Government Official Information and Meetings Act 1987 (LGOIMA) is a New Zealand law that provides public access to information held by local authorities and council-controlled organizations. It also sets transparency standards for local government meetings, ensuring public notification and accessibility.
New Zealand Government • New Zealand • v23 December 2023
WA Digital Security Policy — Western Australia Digital Security Policy
The West Australian Whole of Government Digital Security Policy provides guidelines for adopting and maintaining security controls in digital information and systems. It addresses confidentiality, integrity, and availability, relying on both Australian and international standards.
Australian Government • Australia
Royal Decree 69/2008 — Electronic Transactions Law in Oman
The Electronic Transactions Law in Oman, enacted in 2008 through Royal Decree 69/2008, aims to streamline electronic transactions and ensure their security. It establishes provisions for authentication service providers, e-signature confidentiality, and data integrity.
Government of Oman • Oman
ASD Essential 8 Maturity Model - 2023 — Australian Signals Directorate (ASD) Essential Eight Maturity Model 2023
The ASD Essential 8 Maturity Model is a framework developed by the Australian Signals Directorate (ASD) to guide organizations in implementing prioritized cyber security mitigation strategies. It provides structured maturity levels to help organizations progressively strengthen their defenses against common cyber threats. The model ensures consistency, accountability, and resilience by aligning practices across all eight strategies.
Australian Signals Directorate (ASD) • Australia • vNovember 2023
Cyber Essentials Danzell Question Set — Cyber Essentials Question Set v3.3 (Danzell) April 2026
Cyber Essentials: Requirements for IT Infrastructure v3.3 Question Set is a structured self-assessment designed to help organizations evaluate their cyber security practices. It focuses on five key technical control areas—firewalls, secure configuration, user access control, malware protection, and patch management. By completing the question set, organizations can demonstrate compliance with baseline security standards and strengthen resilience against common cyber threats.
National Cyber Security Centre (NCSC) • v3.3
ISO/IEC 27018:2025 — ISO/IEC 27018:2025 Information security, cybersecurity and privacy protection — Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
ISO/IEC 27018:2025 is the global standard for managing personally identifiable information (PII) in public cloud services. It provides cloud providers with a framework to ensure privacy, security, and compliance when processing customer data.
International Organization for Standardization (ISO) • v2025
ISM CCM — Information Security Manual Cloud Controls Matrix Template
The Cloud Controls Matrix (CCM) Template is a comprehensive framework for mapping cloud security controls to industry standards and compliance requirements. It helps organizations assess, implement, and demonstrate effective cloud security practices across diverse environments.
Australian Government • Australia • vJune 2026
ISM SSP — Information Security Manual System Security Plan Annex Template
The System Security Plan (SSP) Annex Template is a structured document used to capture detailed information about an organization’s cyber security controls and implementation. It supports accreditation processes by providing evidence of compliance, risk management, and system-specific security measures.
Australian Government • Australia • vJune 2026
RFFR ISM SoA — Right Fit for Risk Information Security Manual Statement of Applicability
The Right Fit for Risk (RFFR) Statement of Applicability (SoA) is a structured template used to document how organizations meet cyber security accreditation requirements. It outlines applicable controls, their implementation status, and provides assurance of compliance with the RFFR framework.
Australian Government • Australia • vJune 2026
ISM — Information Security Manual
The Australian ISM is the nationally recognized cybersecurity framework developed by the Australian Signals Directorate. It provides organizations with structured guidance to safeguard information and operational technology systems against evolving cyber threats.
Australian Government • Australia • vJune 2026
PRIS Act — Privacy and Responsible Information Sharing Act 2024
The Privacy and Responsible Information Sharing Act 2024 (PRIS Act) establishes a privacy framework for the Western Australian public sector. It introduces Information Privacy Principles (IPPs) and provisions for privacy complaints, privacy impact assessments, and a notifiable information breach scheme.
Government of Western Australia • Western Australia
India - (DPDP) Rules — India - Digital Personal Data Protection (DPDP) Rules
The Digital Personal Data Protection Rules, 2025 operationalize India’s Digital Personal Data Protection Act, 2023 by establishing detailed requirements for the collection, processing, storage, and protection of digital personal data. The Rules define obligations for organizations handling personal data, including consent management, breach notifications, data retention, and protections for children and vulnerable individuals. They also establish governance mechanisms such as the Data Protection Board and provide a phased implementation timeline for compliance.
Government of India • India • v2025
India - PDPD Act — India - Digital Personal Data Protection (PDPD) Act (Act No. 22 of 2023)
The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) establishes India’s legal framework for processing digital personal data while balancing individuals’ privacy rights with lawful data use. The Act defines obligations for organizations handling personal data, grants rights and duties to individuals, and introduces requirements for consent, data protection, and breach accountability. It also establishes the Data Protection Board of India to oversee compliance, adjudication, and enforcement of penalties for violations.
Government of India • India • v2023
Safe & Trusted Internet — Guidelines on Information Security Practices for Government Entities
The Safe & Trusted Internet Guidelines on Information Security Practices for Government Entities, issued by the Indian Computer Emergency Response Team (CERT-In), establish baseline cyber security controls and best practices to help government entities protect ICT infrastructure, systems, networks, and data against evolving cyber threats and strengthen India’s digital security posture.
Indian Computer Emergency Response Team (CERT-In) Ministry of Electronics and Information Technology Government of India • India
CBK Law — Law No. (32) of 1968 Concerning Currency, The Central Bank of Kuwait and The Regulation of Banking
Law No. (32) of 1968 establishes the legal framework for the establishment and operation of the Central Bank of Kuwait (CBK) and governs currency issuance, banking regulations, and financial supervision within Kuwait. It includes amendments to address evolving economic and regulatory needs.
Central Bank of Kuwait • Kuwait • v2021
PDSP — Protective Data Security Plan (PDSP) Single organisation PDSP form Version 3.7
Victorian public sector bodies are required to report on their information security practices to the Office of the Victorian Information Commissioner (OVIC). This includes submitting Protective Data Security Plans (PDSPs), annual attestations, and notifying OVIC of security incidents as outlined under the Victorian Protective Data Security Framework and Standards (VPDSF, VPDSS).
Office of the Victorian Information Commissioner (OVIC) • Victoria, Australia • v3.7
SOCIA 2018 — Security of Critical Infrastructure Act 2018
The Security of Critical Infrastructure Act 2018 (SOCIA) establishes a regulatory framework for managing national security risks to Australia’s critical infrastructure sectors. It introduces statutory obligations, reporting requirements, and oversight mechanisms for critical assets.
Australian Department of Home Affairs • Australia • vNo. 29, 2018
Privacy Act
The Privacy Act of Canada governs the collection, use, retention, and disclosure of personal information by federal government institutions. It ensures that individuals have the right to access and correct their personal information held by the government.
Government of Canada • Canada
National Greenhouse and Energy Reporting Act 2007
The National Greenhouse and Energy Reporting Act 2007 establishes a national framework for corporations to report their greenhouse gas emissions, energy production, and energy consumption. It aims to improve data transparency and inform government policy on climate change.
Australian Government • Australia
Fair Work Regulations 2009
The Fair Work Regulations 2009 provide detailed legislative backing to the Fair Work Act 2009, outlining the operational rules and requirements for employment relationships, industrial agreements, and workplace standards in Australia. It includes rules on employer obligations, employee protections, and compliance mechanisms.
Department of Employment and Workplace Relations (DEWR) • Australia
Clean Energy Act 2011
The Clean Energy Act 2011 establishes the framework for implementing a carbon pricing mechanism in Australia. It includes provisions for covered entities, emission obligations, and limits on emissions units.
Parliament of Australia • Australia
C2M2 — Cybersecurity Capability Maturity Model
The Cybersecurity Capability Maturity Model (C2M2) is a tool developed by the U.S. Department of Energy to help organizations evaluate and enhance their cybersecurity capabilities. It focuses on both IT and OT environments, offering a structured framework of over 350 practices organized into 10 domains.
U.S. Department of Energy • United States • v2.1
ECC 2-2024 — Essential Cybersecurity Controls
The Essential Cybersecurity Controls (ECC 2-2024) aim to enhance cybersecurity at the national level in Saudi Arabia. They provide policies and controls to protect the information and technological assets of national entities.
National Cybersecurity Authority • Kingdom of Saudi Arabia • v2-2024
DCC-1:2022 — Data Cybersecurity Controls
The Data Cybersecurity Controls (DCC-1:2022) establish minimum cybersecurity requirements to protect data throughout its lifecycle. Issued by the Saudi National Cybersecurity Authority, the controls build on existing cybersecurity frameworks to enhance the Kingdom's overall cybersecurity maturity.
National Cybersecurity Authority (NCA) • Kingdom of Saudi Arabia • v1:2022
IS18 — Information and Cyber Security Policy (IS18)
The Information and Cyber Security Policy (IS18) is a policy framework established by the Queensland Government to enhance information security and organizational resilience. It mandates the implementation of ISO 27001-based ISMS, systematic risk management, and compliance with the Australian Signals Directorate's Essential Eight Strategies for all Queensland Government agencies.
Queensland Government • Queensland, Australia • v9.0.0
UAE Personal Data Protection Law — Federal Decree Law No. 45 of 2021 Regarding the Protection of Personal Data
The UAE Personal Data Protection Law establishes an integrated framework to ensure the confidentiality of information and protect individual privacy in the UAE. It governs the processing of personal data, defines the rights of data owners, sets requirements for cross-border data transfer, and outlines obligations for businesses handling personal data.
UAE Data Office • United Arab Emirates • v20 Sep 2021
Privacy and Data Protection Act 2014 — Privacy and Data Protection Act 2014 Version No. 032
The Privacy and Data Protection Act 2014 establishes a framework for protecting personal information and ensuring data security within the State of Victoria, Australia. It sets out responsibilities for Victorian public sector agencies regarding personal data handling and protections.
Victorian Government • Victoria, Australia • version No. 032
VPDSS 2.0 — Victorian Protective Data Security Standards V2.0
The Victorian Protective Data Security Standards (VPDSS) establish 12 high-level mandatory requirements for the protection of public sector information in Victoria, Australia. These requirements cover governance, information, personnel, ICT, and physical security, focusing on a risk-managed approach tailored to the Victorian government context.
Office of the Victorian Information Commissioner (OVIC) • Victoria, Australia • v2.0
Manage Government compliance with 6clicks
The 6clicks platform maps these regulations to controls, evidence and risks — automatically.