Frameworks / Standards we trace
Standards we trace
Every standard and law our frameworks cover, and where to find it.
A topic framework is anchored on one Primary standard and incorporates Secondary standards where the Primary leaves gaps. Some carry a second standard as a certification profile. Single standards are not products: each has a profile, its view of the topic framework that covers it.
The standard tells you what is required. The framework tells you how to do it, whether you've done enough to certify, and how to keep getting better once you have.
ISO/IEC 17
-
ISO 15489Practice standard
On request: Records & Information Management (specialist framework) Ask about a custom framework.
-
ISO 22301Certification standard
On request: Business Continuity Management (specialist framework) Ask about a custom framework.
-
ISO 27799Practice standard
On request: Health Information Security (specialist framework) Ask about a custom framework.
-
ISO 31000Practice standard
Incorporated in Third-Party Risk Governance
-
ISO 31700-1Practice standard
Incorporated in Privacy Management · Profile: Privacy by Design
-
ISO 8000Practice standard
Incorporated in Enterprise Data Governance
-
ISO/IEC 23894Practice standard
Incorporated in AI Governance · On request: Agentic AI Governance (specialist framework), AI Governance Stack (specialist framework)
-
ISO/IEC 25012Practice standard
Incorporated in Enterprise Data Governance
-
ISO/IEC 27001Certification standard
Anchors Information Security · Certification profile in Unified Governance Framework · Incorporated in Payment Card Security · Profile: ISO/IEC 27001 Information Security · On request: Qatar Banking Data Handling Standards (regional framework), Health Information Security (specialist framework), AI Governance Stack (specialist framework), Application Risk Controls (specialist framework)
-
ISO/IEC 27002Practice standard
Incorporated in Information Security · On request: Qatar Banking Data Handling Standards (regional framework)
-
ISO/IEC 27017Certification standard
Incorporated in Information Security · Profile: Cloud Security & Privacy
-
ISO/IEC 27018Certification standard
Incorporated in Information Security
-
ISO/IEC 27036Practice standard
Anchors Third-Party Risk Governance
-
ISO/IEC 27701Certification standard
Anchors Privacy Management · Certification profile in Unified Governance Framework · Incorporated in Global Privacy · On request: Qatar Banking Data Handling Standards (regional framework), AI Governance Stack (specialist framework), Application Risk Controls (specialist framework)
-
ISO/IEC 38505Practice standard
Incorporated in Enterprise Data Governance · Profile: ISO/IEC 38505 Governance of Data · On request: Qatar Banking Data Handling Standards (regional framework)
-
ISO/IEC 42001Certification standard
Anchors AI Governance, Canadian AI Governance, AI Governance Essentials · Certification profile in Unified Governance Framework · Profile: ISO/IEC 42001 AI Management System · On request: Clinical AI Governance (specialist framework), Agentic AI Governance (specialist framework), AI Governance Stack (specialist framework), Application Risk Controls (specialist framework)
-
ISO/IEC 42005Practice standard
Incorporated in AI Governance · Profile: AI Impact Assessment
Industry & international 15
-
BCBS 239Law or regulation
On request: Qatar Banking Data Handling Standards (regional framework), BCBS 239 Risk Data Aggregation (specialist framework) Ask about a custom framework.
-
CIS ControlsPractice standard
Incorporated in Information Security
-
DAMA-DMBOKPractice standard
Anchors Enterprise Data Governance · Incorporated in Unified Governance Framework · On request: Qatar Banking Data Handling Standards (regional framework)
-
DCAMPractice standard
Incorporated in Enterprise Data Governance
-
FIPPsPractice standard
Incorporated in Privacy Management
-
Good ML PracticePractice standard
On request: Clinical AI Governance (specialist framework) Ask about a custom framework.
-
IEC 62304Practice standard
On request: Medical Device Software (SaMD) (specialist framework) Ask about a custom framework.
-
IEEE 7000Practice standard
Incorporated in Unified Governance Framework
-
IEEE Data GovernancePractice standard
Incorporated in Enterprise Data Governance
-
ISO 13485Certification standard
On request: Medical Device Software (SaMD) (specialist framework) Ask about a custom framework.
-
ISO 14971Practice standard
On request: Medical Device Software (SaMD) (specialist framework) Ask about a custom framework.
-
OECD AI PrinciplesPractice standard
Incorporated in AI Governance, Data Ethics · On request: Agentic AI Governance (specialist framework), AI Governance Stack (specialist framework)
-
PCI DSSCertification standard
Anchors Payment Card Security · Incorporated in Information Security · On request: Application Risk Controls (specialist framework)
-
SOC 2 (AICPA TSC)Certification standard
Incorporated in Information Security · Profile: SOC 2 Readiness
-
UNESCO AI EthicsPractice standard
Incorporated in Data Ethics
United States 10
-
CCPA/CPRALaw or regulation
Anchors US Privacy · Incorporated in Global Privacy
-
CMMC / SP 800-171Certification standard
On request: Defence Supply Chain Cybersecurity (specialist framework) Ask about a custom framework.
-
Colorado AI ActLaw or regulation
On request: US State AI Laws (specialist framework) Ask about a custom framework.
-
COPPALaw or regulation
Incorporated in Global Privacy, US Privacy · On request: Children's Privacy & Age-Appropriate Design (specialist framework)
-
HIPAALaw or regulation
Incorporated in US Privacy · Profile: HIPAA (US health information)
-
NIST AI RMFPractice standard
Incorporated in AI Governance, Canadian AI Governance, Unified Governance Framework · Profile: NIST AI Risk Management · On request: Agentic AI Governance (specialist framework), AI Governance Stack (specialist framework), US State AI Laws (specialist framework)
-
NIST CSF 2.0Practice standard
Incorporated in Information Security, Unified Governance Framework · Profile: NIST Cybersecurity Framework · On request: Qatar Banking Data Handling Standards (regional framework), Application Risk Controls (specialist framework)
-
NIST Privacy FrameworkPractice standard
Incorporated in Global Privacy, Privacy Management, US Privacy · Profile: NIST Privacy Framework
-
NIST SP 800-53Practice standard
Not yet in a topic framework. Ask about a custom framework.
-
US state privacy lawsLaw or regulation
Incorporated in US Privacy
EU & UK 8
-
DORALaw or regulation
Incorporated in Third-Party Risk Governance · On request: EU DORA Digital Operational Resilience (specialist framework)
-
EU AI ActLaw or regulation
Incorporated in AI Governance, AI Governance Essentials · Profile: EU AI Act · On request: Clinical AI Governance (specialist framework), Agentic AI Governance (specialist framework), AI Governance Stack (specialist framework), Application Risk Controls (specialist framework)
-
EU Data ActLaw or regulation
On request: EU Data Act (specialist framework) Ask about a custom framework.
-
EU MDRLaw or regulation
On request: Medical Device Software (SaMD) (specialist framework) Ask about a custom framework.
-
GDPRLaw or regulation
Anchors Global Privacy · Certification profile in Unified Governance Framework · Incorporated in Privacy Management · Profile: GDPR · On request: Children's Privacy & Age-Appropriate Design (specialist framework), AI Governance Stack (specialist framework), Application Risk Controls (specialist framework)
-
NIS2Law or regulation
On request: EU NIS2 (specialist framework) Ask about a custom framework.
-
UK Children's CodeLaw or regulation
Incorporated in Global Privacy · On request: Children's Privacy & Age-Appropriate Design (specialist framework)
-
UK GDPRLaw or regulation
Certification profile in Global Privacy
Canada 15
-
Alberta PIPALaw or regulation
Incorporated in Canadian Privacy
-
BC PIPALaw or regulation
Incorporated in Canadian Privacy
-
CAN/DGSI 101Practice standard
Incorporated in Canadian AI Governance
-
CPCSCCertification standard
On request: Defence Supply Chain Cybersecurity (specialist framework) Ask about a custom framework.
-
GoC Agentic AI GuidePractice standard
On request: Agentic AI Governance (specialist framework) Ask about a custom framework.
-
IPC Ontario PIA GuidePractice standard
Incorporated in Canadian Privacy · Profile: Privacy Impact Assessment (Ontario public sector)
-
Ontario Bill 194Law or regulation
Incorporated in Canadian AI Governance
-
Ontario FIPPA/MFIPPALaw or regulation
Incorporated in Canadian Privacy
-
Ontario PHIPALaw or regulation
Incorporated in Canadian Privacy · Profile: Canadian Health Information Privacy
-
OPC PIA GuidePractice standard
Incorporated in Canadian Privacy
-
OSFI GuidelinesLaw or regulation
Incorporated in Canadian AI Governance, Third-Party Risk Governance · On request: OSFI Technology & Resilience Suite (regional framework)
-
PIPEDALaw or regulation
Anchors Canadian Privacy · Certification profile in Unified Governance Framework · Incorporated in Global Privacy
-
Quebec Law 25Law or regulation
Certification profile in Canadian Privacy · Incorporated in Global Privacy · Profile: Quebec Law 25
-
TBS Directive on ADMLaw or regulation
Incorporated in Canadian AI Governance
-
Voluntary Code on Generative AIPractice standard
Incorporated in Canadian AI Governance
GCC 10
-
Bahrain PDPLLaw or regulation
Incorporated in Gulf Data Protection
-
Qatar National Data PolicyLaw or regulation
Incorporated in Gulf Data Protection · On request: Qatar National Data Governance (regional framework)
-
Qatar NIALaw or regulation
On request: Saudi Cybersecurity (regional framework), Qatar National Data Governance (regional framework), Qatar Banking Data Handling Standards (regional framework) Ask about a custom framework.
-
Qatar PDPPLLaw or regulation
Certification profile in Gulf Data Protection · Incorporated in Global Privacy · On request: Qatar National Data Governance (regional framework), Qatar Banking Data Handling Standards (regional framework)
-
QCB Data RegulationLaw or regulation
Incorporated in Gulf Data Protection · On request: Qatar National Data Governance (regional framework), Qatar Banking Data Handling Standards (regional framework)
-
SAMA CSFLaw or regulation
On request: Saudi Cybersecurity (regional framework) Ask about a custom framework.
-
Saudi NCA ECCLaw or regulation
On request: Saudi Cybersecurity (regional framework) Ask about a custom framework.
-
Saudi NDMOLaw or regulation
Incorporated in Gulf Data Protection · On request: Saudi National Data Management (regional framework)
-
Saudi PDPLLaw or regulation
Anchors Gulf Data Protection · Certification profile in Unified Governance Framework · Incorporated in Global Privacy · On request: Saudi National Data Management (regional framework)
-
UAE PDPLLaw or regulation
Incorporated in Global Privacy, Gulf Data Protection
Latin America 1
-
LGPD (Brazil)Law or regulation
Incorporated in Global Privacy
Standards are referenced by clause, not reproduced. Names of standards and laws are trademarks of their owners; DP Frameworks is not affiliated with or endorsed by any standards body or regulator. Frameworks support governance and readiness; they are not legal advice or a regulatory submission.