Compliance · Framework library

Every framework and the evidence behind it.

29 frameworks in 9 jurisdictions plus global standards, with 122+ controls, and Middle East frameworks mapped at onboarding. Open any framework to see whether each control is proved by a live signal or by the assessment.

By jurisdiction

Available frameworks.

Each page is generated from the same crosswalk the product scores against, so the library changes when the crosswalk does.

Australia

ACSC Secure AIACSC / ASD5 controlsEssential EightACSC / ASD5 controlsAPRA CPS 234APRA5 controlsPrivacy Act 1988OAIC5 controlsSOCI ActDept Home Affairs / CISC4 controlsASIC RG 271ASIC5 controlsASX PrinciplesASX Corporate Governance Council3 controlsAPS responsible AIDISR / DTA3 controls

Global standards

OWASP LLM Top 10OWASP GenAI Security Project11 controlsISO/IEC 42001ISO/IEC5 controlsISO/IEC 27001ISO/IEC4 controlsMITRE ATLASMITREtechnique map

United States

NIST AI RMFNIST5 controlsNIST SSDFNIST3 controlsSOC 2AICPA3 controls

European Union

EU AI ActEuropean Parliament & Council8 controlsGDPREuropean Parliament & Council10 controlsDORAEuropean Parliament & Council / ESAs (EBA, ESMA, EIOPA)4 controlsNIS2European Parliament & Council4 controlsCyber Resilience ActEuropean Parliament & Council; ENISA + national market-surveillance authorities6 controls

Singapore

MAS TRM · FEATMonetary Authority of Singapore3 controlsPDPA · IMDAPDPC / IMDA1 control

Malaysia

BNM RMiTBank Negara Malaysia (BNM)5 controls

India

DPDP Act 2023MeitY (India)2 controls

Japan

APPIPersonal Information Protection Commission (PPC)5 controlsAI Promotion ActCabinet Office / AI Strategy Headquarters2 controlsMETI AI GuidelinesMinistry of Economy, Trade and Industry (METI) & Ministry of Internal Affairs and Communications (MIC)4 controls

Hong Kong

HKMA GenAIHong Kong Monetary Authority1 control

China

PIPLCAC (China)1 control

Middle East · available, mapped at onboarding

Personal Data Protection Law (PDPL)SDAIA · In force since September 2024.Available · mapped at onboarding
SAMA Cyber Security FrameworkSaudi Central Bank (SAMA) · For banks, insurers and finance companies.Available · mapped at onboarding
NCA Essential Cybersecurity ControlsNational Cybersecurity Authority · Baseline controls for government and critical sectors.Available · mapped at onboarding
AI Ethics PrinciplesSDAIA · National principles for building and using AI.Available · mapped at onboarding
Federal Decree-Law No. 45 of 2021 (PDPL)UAE Data Office · Federal personal data protection law.Available · mapped at onboarding
DIFC Data Protection Law 2020 and Regulation 10DIFC Commissioner of Data Protection · Regulation 10 covers personal data processed by autonomous and AI systems.Available · mapped at onboarding
ADGM Data Protection Regulations 2021ADGM Office of Data Protection · Abu Dhabi Global Market free zone.Available · mapped at onboarding
Personal Data Privacy Protection Law (Law No. 13 of 2016)National Cyber Security Agency · Qatar’s personal data law.Available · mapped at onboarding
Personal Data Protection Law (Law No. 30 of 2018)Personal Data Protection Authority · Bahrain’s personal data law.Available · mapped at onboarding
Personal Data Protection Law (Royal Decree 6/2022)Ministry of Transport, Communications and IT · Oman’s personal data law.Available · mapped at onboarding

Middle East frameworks are mapped to your controls when you join, so they have no generic page here and are not counted in the 29. MITRE ATLAS is used as a technique map: it names the technique behind each finding and carries no controls of its own.

Roadmap

Not yet mapped, and not counted.

These frameworks are on the roadmap. They are not in the crosswalk and show no evidence until the platform maps them.

AI Basic ActMinistry of Science and ICT · Korea’s framework act on AI, in force from January 2026.On the roadmap
APRA CPS 230 Operational Risk ManagementAPRA · In force since July 2025, amended from 1 July 2026. Coming to the framework mapping.On the roadmap
Personal Data Protection Law (Law No. 27 of 2022)Government of Indonesia · Fully in force since October 2024.On the roadmap
Colorado AI Act (SB 24-205)State of Colorado · Repealed and re-enacted in May 2026 as automated decision-making disclosure duties, from 1 January 2027.On the roadmap
Open the framework explorerRegulator-ready evidence