Framework library
Six guides covering the frameworks buyers ask about most. Each one states what the framework requires, lists the evidence an auditor will ask for, and works through a readiness sample with owners and due dates attached.
Coverage map
Pick a framework to see where it applies, or pick a region to read the regulations and data-residency requirements that come with it.
Sample data Region coverage, regulations, and residency notes are sample data for the demo.
Choose a region above to read its regulation list. With JavaScript off, every region’s list is shown here in full, and the table below the map carries the same sample data.
Frameworks that apply here: SOC 2 , ISO 27001 , HIPAA , PCI DSS , CCPA / CPRA
Frameworks that apply here: SOC 2 , ISO 27001
Frameworks that apply here: SOC 2 , ISO 27001 , GDPR , PCI DSS
Frameworks that apply here: ISO 27001
Frameworks that apply here: SOC 2 , ISO 27001 , PCI DSS
| Region | Regulation | Data-residency requirement | Frameworks that apply |
|---|---|---|---|
| North America | HIPAA | Protected health information stays in contracted US regions, under a signed business associate agreement. | SOC 2, ISO 27001, HIPAA, PCI DSS, CCPA / CPRA |
| CCPA / CPRA | No residency mandate. Consumer rights — access, deletion, opt-out of sale or sharing — apply to California residents. | ||
| State breach notification laws | No residency mandate. Notification duties follow the affected person’s state of residence. | ||
| Latin America | LGPD (Brazil) | No strict residency mandate. International transfers need a lawful transfer mechanism, such as standard clauses. | SOC 2, ISO 27001 |
| LFPDPPP (Mexico) | No residency mandate. Consent and privacy-notice duties apply to personal data processing. | ||
| Europe | GDPR | Hosting inside the EEA is available. Transfers outside the EEA need an adequacy decision or standard contractual clauses. | SOC 2, ISO 27001, GDPR, PCI DSS |
| NIS2 Directive | No residency mandate. Incident reporting duties apply to essential and important entities. | ||
| Africa | POPIA (South Africa) | Transfers are allowed to jurisdictions with comparable protection, or with consent or a binding agreement in place. | ISO 27001 |
| NDPA (Nigeria) | Cross-border transfers need a lawful basis and, for some transfers, Data Protection Commission approval. | ||
| Asia-Pacific | PDPA (Singapore) | No residency mandate. Organisations must ensure a comparable standard of protection when data goes overseas. | SOC 2, ISO 27001, PCI DSS |
| Privacy Act 1988 (Australia) | No residency mandate. APP 8 keeps the disclosing organisation accountable for overseas handling. | ||
| APPI (Japan) | Transfers need consent, or a destination with an equivalent protection system, such as APEC CBPR certification. |
The library
Sample data Control counts are the tracked controls in each guide's readiness sample.
Attestation
Type I and Type II reports over the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.
Security standard
Information security management system requirements and the Annex A control set, mapped to owners, evidence, and review dates.
Privacy regulation
Records of processing, lawful basis tracking, data subject request deadlines, and transfer assessments for the EU General Data Protection Regulation.
Health regulation
Administrative, physical, and technical safeguards for protected health information, with business associate agreement tracking.
Payment standard
The twelve requirement groups of the Payment Card Industry Data Security Standard, version 4.0, with evidence mapped per requirement.
Privacy regulation
California consumer privacy rights: notice at collection, opt-out of sale or sharing, and service provider contract terms.
No guides match the current search and filters. Clear a filter or try a shorter search.