Security Standards, Compliance Frameworks & Governance Bodies

A Cross-Jurisdictional Reference Catalogue -- UK, EU, USA and Canada

CyberCQR Reference Catalogue | 16 September 2026 | Version 1.0

Introduction and Scope

This catalogue brings together the security standards, regulatory frameworks, certification schemes and governance bodies that a UK-headquartered organisation with international operations is most likely to encounter. It spans government and statutory regulation, industry-mandated certification, and voluntary best-practice frameworks across the United Kingdom, the European Union, the United States and Canada, together with the international standards, including ISO, PCI DSS, SOC, CIS and OWASP, that underpin many of them.

Coverage is organised by jurisdiction first, then by cross-border framework, because obligations typically attach to where an organisation operates, where its customers sit, and which sector it serves, rather than to a single global rulebook. A sector applicability matrix at the end cross-references the entries most relevant to financial services, defence and government, cloud and technology, healthcare, and critical national infrastructure.

This is a living reference. Standards are revised, superseded and occasionally withdrawn, so each entry should be checked against the owning body's current publication before being relied upon in a compliance programme. Where a framework has multiple tiers or levels, such as PCI DSS or CMMC, the summary describes how those tiers are differentiated rather than listing every sub-requirement.

Governance Frameworks vs Technical Standards

Two different kinds of document get grouped together under cybersecurity standards and confusing them is a common source of failed audits and unenforceable policy. Governance frameworks -- ISO/IEC 27001, NIST CSF, SOC 2 -- are descriptive: they state outcomes an organisation must achieve and leave the organisation to decide how. Technical standards -- CIS Benchmarks, DISA STIGs, the OWASP ASVS -- are prescriptive: they specify the exact configuration, script or code check that satisfies a given outcome.

Neither tier is sufficient alone. A governance framework without a technical standard behind it produces policies nobody can test; e.g. access shall be restricted appropriately means nothing to an auditor until someone defines what an appropriate password policy or session timeout is. A technical standard without a governance framework above it produces hardened systems nobody has prioritised: an engineer can drive a server to 100% CIS Benchmark compliance while the organisation's genuinely critical asset, three systems along, remains unpatched, because nothing above the technical layer decided that asset mattered more.

Comparing the Two Tiers

Dimension	Governance / Descriptive Frameworks	Technical / Prescriptive Standards
Primary question	What outcome must we achieve?	What exact setting satisfies that outcome?
Typical audience	Board, CISO, auditors, risk committees	System administrators, security engineers, developers
Level of detail	Outcome statements and control objectives	Line-by-line configuration values and pass/fail checks
How it is assessed	External certification audit or attestation, on a sampling basis	Automated configuration scan or manual technical check, against every instance
Revision cadence	Every 3-5 years (e.g. ISO/IEC 27001:2022)	With every operating system or software version release
Applies across	Any sector, any technology stack	One specific product, platform or version
Example requirement	Access to information shall be restricted in accordance with the organisation's access control policy (ISO/IEC 27001 Annex A 5.15)	Set the maximum password age to 30 days or fewer for interactive logon accounts (a CIS Benchmark setting)
Typical evidence produced	Statement of Applicability, risk register, management review minutes	Scan report, percentage-compliant score, remediation ticket

Section G works through a concrete example of how these two tiers interact in practice and explains the specific Type label attached to every entry in Sections A-E below.

How to Use This Catalogue

Each table lists the standard or framework by name, the body that owns and maintains it, its jurisdictional scope, its Type -- colour-coded, and explained in full in Section G -- and a short summary of what it requires. Each standard's name is a link that jumps to its entry in the References section, which gives the owning body's primary web address as a clickable URL. Entries within each table are ordered alphabetically by name; sections are grouped first by jurisdiction, and then by cross-border standards that apply globally regardless of where an organisation is based.

Structure

Section A -- United Kingdom
Section B -- European Union
Section C -- United States
Section D -- Canada
Section E -- International / Cross-Border Standards
Section F -- Applicability by Sector
Section G -- Type Classifications and the Governance-to-Technical Integration Model

Section A: United Kingdom

UK obligations combine NCSC-owned baselines and certifications, statutory data protection and NIS law, financial services regulation from the FCA and PRA, and a distinct defence security regime run by the Ministry of Defence.

Standard / Framework	Owning Body	Jurisdiction / Scope	Type	Summary
Bank of England CBEST	Bank of England / FCA / PRA	UK financial market infrastructure	Regulatory testing scheme	Intelligence-led penetration testing framework that simulates real adversaries against critical financial systems.
Cyber Essentials	NCSC / IASME	UK, all sectors (widely required for gov contracts)	Certification (self-assessed)	Five technical controls -- firewalls, secure configuration, access control, malware protection, patch management -- verified by an external certification body.
Cyber Essentials Plus	NCSC / IASME	UK, all sectors	Certification (independently tested)	As Cyber Essentials, plus hands-on technical verification including internal and external vulnerability testing.
Def Stan 05-138	MOD / Defence Standardisation	UK defence supply chain	Contractual	Cyber security requirements for defence suppliers, tiered by risk under the Cyber Risk Profile model.
Def Stan 05-139	MOD / Defence Standardisation	UK defence industry	Contractual	Cyber security requirements for MOD contractors delivering defence-related IT and communication systems.
Defence Cyber Protection Partnership (DCPP)	MOD & industry partners	UK defence supply chain	Collaborative scheme	Joint MOD-industry initiative defining cyber risk profiles and proportionate controls across the defence supply chain.
FCA Handbook -- SYSC	Financial Conduct Authority	UK regulated financial firms	Statutory/regulatory	Systems and controls requirements covering technology risk, outsourcing and operational resilience for FCA-authorised firms.
FCA/PRA Operational Resilience (PS21/3, SS1/21)	FCA & PRA	UK financial services	Statutory	Requires firms to identify important business services, set impact tolerances, and test resilience to severe but plausible disruption, including cyber.
GovAssure	Cabinet Office / NCSC	UK central government departments	Mandatory (government)	Independent annual cyber assurance regime for government departments, based on the NCSC Cyber Assessment Framework.
Government Security Classifications Policy (GSCP)	Cabinet Office	UK public sector	Mandatory (government)	Defines OFFICIAL, SECRET and TOP SECRET classification tiers and the handling controls attached to each.
GovS 007: Government Functional Standard for Security	Cabinet Office	UK Civil Service departments	Mandatory (government)	Overarching functional standard for security governance across government, of which the Minimum Cyber Security Standard and GovAssure are subordinate components.
ICO Accountability Framework	Information Commissioner's Office	UK organisations processing personal data	Regulatory guidance	Practical expectations for demonstrating UK GDPR/DPA compliance across ten accountability categories.
List X	MOD / Defence Business Services	UK companies holding classified MOD contracts	Mandatory accreditation	Physical, personnel and information security accreditation for sites storing SECRET material under MOD contract.
Minimum Cyber Security Standard (MCSS)	Cabinet Office	UK government departments	Mandatory (government)	Baseline technical and procedural controls departments must meet under GovS 007.
MOD JSP 440	Ministry of Defence	UK defence & suppliers handling MOD information	Mandatory (MOD)	Defence manual of security policy covering information, personnel and physical security requirements.
MOD JSP 604	Ministry of Defence	UK MOD contractors	Mandatory (MOD)	Departmental security instructions for industry handling protectively marked defence material.
NCSC 10 Steps to Cyber Security	NCSC	UK, all sectors	Guidance (voluntary)	Foundational baseline of ten security domains used by boards to govern organisational cyber risk.
NCSC Cyber Assessment Framework (CAF)	NCSC	UK critical national infrastructure & NIS-regulated entities	Mandatory (regulated sectors)	Outcome-based framework of 4 objectives and 14 principles used by regulators to assess cyber resilience.
NHS Data Security and Protection Toolkit (DSPT)	NHS England	UK health & social care organisations	Mandatory (NHS contracts)	Annual self-assessment against the National Data Guardian's ten security standards for health and care data.
NIS Regulations 2018 (as amended)	DSIT / Ofcom / sector regulators	UK operators of essential services & digital service providers	Statutory	Requires appropriate security measures and incident reporting for energy, transport, health, water and digital infrastructure operators.
PRA Supervisory Statement SS2/21	Bank of England PRA	UK banks, insurers	Regulatory expectation	Sets expectations for managing outsourcing and third-party (including cloud) risk in regulated financial firms.
Product Security and Telecommunications Infrastructure Act 2022 (PSTI Act)	Department for Science, Innovation and Technology	UK consumer connectable products	Statutory	Bans default or weak passwords, and mandates vulnerability disclosure policies and minimum-security update periods, for smart consumer devices sold in the UK.
Secure by Design (UK Government)	Central Digital and Data Office	UK government digital services	Mandatory (government)	Requires security to be designed into government technology and services from inception rather than retrofitted.
UK GDPR & Data Protection Act 2018	ICO / DSIT	UK	Statutory	Post-Brexit retained GDPR governing lawful processing of personal data; enforced by the ICO with fines up to £17.5m or 4% of global turnover.
UK MiFID II (onshored)	Financial Conduct Authority	UK investment firms & trading venues	Statutory	Governs algorithmic trading controls, clock synchronisation, system resilience, and record-keeping obligations for investment services firms.

Section B: European Union

EU obligations increasingly operate as a connected package: GDPR for personal data, NIS2 for essential-entity resilience, DORA for financial-sector ICT risk, and the AI Act and Cyber Resilience Act for emerging technology and product security.

Standard / Framework	Owning Body	Jurisdiction / Scope	Type	Summary
Cyber Resilience Act (CRA)	European Commission	EU products with digital elements	Statutory (phasing in 2026-2027)	Mandates security-by-design, vulnerability handling and CE-marking for connected hardware and software products placed on the EU market.
Cybersecurity Act (EU) 2019/881	European Union Agency for Cybersecurity	EU	Statutory	Establishes ENISA's permanent mandate and the EU cybersecurity certification framework for ICT products, services and processes.
DORA -- Digital Operational Resilience Act	EBA / ESMA / EIOPA	EU financial entities & critical ICT third parties	Statutory (applies from Jan 2025)	Harmonises ICT risk management, incident reporting, resilience testing and third-party oversight across EU financial services.
EBA Guidelines on ICT and Security Risk Management	European Banking Authority	EU credit & payment institutions	Regulatory guidance	Baseline expectations for ICT governance and incident management, since aligned into the DORA regime.
ECB Cyber Resilience Oversight Expectations (CROE)	European Central Bank	EU financial market infrastructures	Supervisory expectations	Sets maturity levels -- baseline, evolving, advanced -- for financial market infrastructures to progress cyber resilience.
eIDAS 2.0 Regulation	European Commission	EU digital identity & trust services	Statutory	Establishes the European Digital Identity Wallet and qualified trust service requirements across Member States.
ENISA	European Union Agency for Cybersecurity	EU	Governance body	EU agency issuing guidance, threat landscape reports and coordinating cybersecurity certification schemes.
ETSI EN 303 645	ETSI	EU/UK consumer IoT	Standard (referenced in regulation)	Baseline security requirements for consumer IoT devices, underpinning the UK PSTI Act and EU radio equipment requirements.
EU Artificial Intelligence Act (Regulation (EU) 2024/1689)	European Commission	EU high-risk AI systems	Statutory	Risk-based regulation requiring governance, data quality, transparency and cybersecurity for AI systems; penalties up to €35m or 7% of turnover.
General Data Protection Regulation (EU) 2016/679	European Commission / EDPB	EU/EEA	Statutory	Governs lawful processing of personal data across the EU/EEA, including Article 32 security-of-processing duties, mandatory DPIAs for high-risk processing, and 72-hour breach notification; fines up to €20m or 4% of global turnover.
NIS2 Directive (EU) 2022/2555	ENISA / Member State authorities	EU essential & important entities	Statutory (transposed nationally)	Expands NIS1 scope, mandating risk management, supply-chain security and 24-hour incident reporting across more sectors.
PSD2 -- Revised Payment Services Directive	European Banking Authority	EU payment service providers	Statutory	Mandates strong customer authentication (SCA) and secure open banking APIs for payment initiation and account access.

Section C: United States

US obligations are fragmented by sector and by federal-versus-state jurisdiction: NIST frameworks and FedRAMP/FISMA govern federal and federally-adjacent systems, sector regulators (HHS, FTC, SEC, FFIEC) own their own rules, and the Department of Defense runs a separate supply-chain certification regime (CMMC).

Standard / Framework	Owning Body	Jurisdiction / Scope	Type	Summary
CCPA / CPRA	California Privacy Protection Agency	California, US (state)	Statutory (state)	Consumer data privacy rights and security obligations for businesses handling Californian residents' personal data.
CJIS Security Policy	FBI Criminal Justice Information Services Division	US law enforcement & partner agencies	Mandatory	Minimum security controls required for access to criminal justice information.
CMMC 2.0 -- Cybersecurity Maturity Model Certification	US Department of Defense	US defence industrial base	Contractual/mandatory (phasing in)	Tiered certification (Levels 1-3) verifying implementation of NIST SP 800-171/172 controls for DoD suppliers.
DFARS 252.204-7012	US Department of Defense	US defence contractors	Contractual	Mandates NIST SP 800-171 compliance and rapid cyber incident reporting for covered defence information.
DISA STIGs (Security Technical Implementation Guides)	Defense Information Systems Agency	US DoD systems; referenced elsewhere	Mandatory (DoD) / reference standard	Prescriptive, technology-specific hardening configurations for operating systems, applications and network devices.
FedRAMP	General Services Administration	US federal cloud services	Mandatory (federal cloud)	Standardised authorisation process for cloud service providers serving government agencies, based on NIST SP 800-53.
FFIEC Cybersecurity Assessment Tool	Federal Financial Institutions Examination Council	US banks & credit unions	Regulatory guidance	Maturity-based self-assessment aligning inherent risk profile with cybersecurity preparedness.
FISMA -- Federal Information Security Modernization Act	OMB / CISA	US federal agencies	Statutory	Requires federal agencies and contractors to implement risk-based information security programmes.
GLBA Safeguards Rule	Federal Trade Commission	US financial institutions	Statutory	Requires a written information security programme protecting customer financial information.
HIPAA Security Rule	HHS / Office for Civil Rights	US healthcare	Statutory	Administrative, physical and technical safeguards required to protect electronic protected health information (ePHI).
NERC CIP	North American Electric Reliability Corporation	US/Canada bulk electric system	Mandatory (regulated)	Critical infrastructure protection standards for the North American bulk power grid.
NIST Cybersecurity Framework (CSF) 2.0	National Institute of Standards and Technology	US; voluntary and widely adopted internationally	Voluntary framework	Six functions -- Govern, Identify, Protect, Detect, Respond, Recover -- for managing organisational cyber risk.
NIST SP 800-171	National Institute of Standards and Technology	US defence/federal contractors handling CUI	Contractual/mandatory (DoD)	Requirements for protecting Controlled Unclassified Information (CUI) in non-federal systems and organisations.
NIST SP 800-37 (Risk Management Framework)	National Institute of Standards and Technology	US federal agencies	Mandatory (federal)	Six-step lifecycle process for categorising, selecting, implementing, assessing and authorising system security controls.
NIST SP 800-53 Rev. 5	National Institute of Standards and Technology	US federal systems & contractors	Mandatory (federal)	Catalogue of security and privacy controls underpinning FedRAMP and FISMA compliance.
NIST SP 800-63 (Digital Identity Guidelines)	National Institute of Standards and Technology	US; referenced globally	Guidance	Digital identity guidelines covering identity proofing, authentication assurance levels and federation.
NYDFS Cybersecurity Regulation (23 NYCRR 500)	New York State Department of Financial Services	New York-regulated financial services entities (state)	Statutory (state)	Requires a designated CISO, a written cybersecurity programme, annual certification of compliance, and 72-hour incident notification for banks, insurers and other DFS-regulated entities.
Sarbanes-Oxley Act (SOX) s.404	SEC / PCAOB	US public companies	Statutory	Requires internal controls over financial reporting, including IT general controls relevant to financial systems.
SEC Cybersecurity Disclosure Rule (2023)	Securities and Exchange Commission	US public companies	Statutory	Mandates disclosure of material cyber incidents on Form 8-K within four business days, plus annual cybersecurity governance and risk management disclosure on Form 10-K.
StateRAMP	StateRAMP (non-profit)	US state/local government cloud services	Voluntary / state-adopted	State-level equivalent of FedRAMP for authorising cloud service providers to state and local government.

Section D: Canada

Canadian obligations sit at both federal and provincial level -- PIPEDA and the Canadian Centre for Cyber Security's guidance apply federally, while Quebec's Law 25 introduces GDPR-style requirements provincially.

Standard / Framework	Owning Body	Jurisdiction / Scope	Type	Summary
CCCS Baseline Cyber Security Controls	Canadian Centre for Cyber Security	Canadian small and medium enterprises	Voluntary (certification basis)	Essential controls programme, modelled on international baselines, underpinning CyberSecure Canada certification.
CCCS ITSG-33	Canadian Centre for Cyber Security	Government of Canada systems	Mandatory (federal)	IT security risk management framework and control catalogue for Government of Canada information systems.
Controlled Goods Program (CGP)	Public Works and Government Services Canada	Canadian defence contractors	Mandatory accreditation	Registration and security regime for organisations examining, possessing or transferring controlled defence-related goods and technology -- Canada's analogue to UK List X.
CyberSecure Canada	Innovation, Science and Economic Development Canada	Canadian SMEs	Voluntary certification	Government-backed certification verifying implementation of the CCCS baseline cyber security controls.
OSFI Guideline B-13	Office of the Superintendent of Financial Institutions	Canadian federally regulated financial institutions	Regulatory	Technology and cyber risk management expectations, including incident reporting and third-party risk oversight.
OSFI Guideline E-21 (Operational Resilience)	Office of the Superintendent of Financial Institutions	Canadian federally regulated financial institutions	Regulatory	Sets critical-operations resilience and severe-but-plausible disruption tolerance requirements, complementing B-13's technology and cyber risk controls.
PIPEDA -- Personal Information Protection and Electronic Documents Act	Office of the Privacy Commissioner of Canada	Canada, private sector (federal)	Statutory (federal)	Federal law governing the collection, use and disclosure of personal information during commercial activity.
Quebec Law 25 (Bill 25)	Commission d'accès à l'information (CAI)	Quebec, Canada	Statutory (provincial)	Modernises Quebec privacy law with GDPR-style consent, breach notification and privacy-by-design duties.

Section E: International / Cross-Border Standards

These standards are not tied to a single jurisdiction. Many UK, EU, US and Canadian regulatory expectations are met in practice by certifying against one or more of the frameworks below, which is why they recur throughout the jurisdictional sections above.

Standard / Framework	Owning Body	Jurisdiction / Scope	Type	Summary
CIS Benchmarks	Center for Internet Security	Global	Voluntary hardening guides	Consensus-based secure configuration guidance for over 100 operating systems, cloud platforms and applications.
CIS Controls v8	Center for Internet Security	Global	Voluntary framework	18 prioritised safeguards grouped into Implementation Groups (IG1-3) scaled to organisational maturity.
COBIT 2019	ISACA	Global	Governance framework	IT governance and management framework aligning technology objectives with enterprise goals.
CSA Cloud Controls Matrix (CCM)	Cloud Security Alliance	Global	Control framework	Cross-referenced cloud-specific control catalogue mapped to ISO 27001, NIST and other frameworks.
CSA STAR (Security, Trust, Assurance and Risk)	Cloud Security Alliance	Global, cloud services	Certification/self-assessment	Tiered cloud assurance programme from Level 1 self-assessment to Level 3 continuous monitoring, built on the CCM.
ISO 22301	International Organization for Standardization	Global	Certification	Business continuity management system standard covering resilience, response and recovery.
ISO 31000	International Organization for Standardization	Global	Guidance	Generic risk management principles and framework applicable across enterprise risk domains.
ISO/IEC 27001	International Organization for Standardization	Global	Certification	Specification for an information security management system (ISMS); the basis for most sector-specific certifications.
ISO/IEC 27002	International Organization for Standardization	Global	Guidance	Code of practice providing detailed implementation guidance for the Annex A controls referenced in ISO 27001.
ISO/IEC 27005	International Organization for Standardization	Global	Guidance	Information security risk management guidance supporting the ISO 27001 risk assessment process.
ISO/IEC 27017	International Organization for Standardization	Global, cloud services	Guidance	Cloud-specific security controls extending ISO 27002 for cloud service providers and customers.
ISO/IEC 27018	International Organization for Standardization	Global, cloud PII processing	Guidance	Protection of personally identifiable information (PII) processed in public cloud services.
ISO/IEC 27701	International Organization for Standardization	Global	Certification	Privacy information management system extension to ISO 27001, supporting GDPR-style accountability.
ISO/IEC 27799	International Organization for Standardization	Global, health informatics	Guidance	Sector-specific guidance for applying ISO 27002 controls to health information security management.
ISO/IEC 42001 (AIMS)	International Organization for Standardization	Global, AI systems	Certification	Management system standard for governing the responsible development, deployment and risk management of artificial intelligence.
MITRE ATLAS	MITRE Corporation	Global, AI systems	Knowledge base	Adversarial Threat Landscape for AI Systems, extending ATT&CK with AI-specific attack techniques.
MITRE ATT&CK	MITRE Corporation	Global	Knowledge base	Adversary tactics and techniques catalogue used for threat modelling, detection engineering and red teaming.
OWASP API Security Top 10	OWASP	Global, API-based systems	Guidance	Ten most critical API-specific security risks -- including broken object-level and function-level authorisation -- as a companion to the main OWASP Top 10.
OWASP ASVS (Application Security Verification Standard)	OWASP	Global	Guidance/testing standard	Defines verifiable application security requirements across three escalating assurance levels.
OWASP SAMM (Software Assurance Maturity Model)	OWASP	Global	Maturity model	Model for assessing and improving an organisation's software security practices across the SDLC.
OWASP Top 10	OWASP	Global	Guidance	Ten most critical web application security risks, updated periodically from industry contribution data.
OWASP Top 10 for LLM Applications	OWASP	Global, AI/LLM systems	Guidance	Prioritised risks for large language model applications, including prompt injection and insecure output handling.
PCI DSS v4.0 (Levels 1-4)	PCI Security Standards Council	Global, card payment ecosystem	Contractual/mandatory (card schemes)	Level 1 (over 6m annual transactions) requires an annual QSA-led Report on Compliance plus quarterly ASV scans; Levels 2 (1-6m) and 3 (20,000-1m e-commerce) require an annual Self-Assessment Questionnaire plus quarterly ASV scans; Level 4 (under 20,000 e-commerce, or up to 1m total) follows the same SAQ/ASV pattern at a lower assurance expectation. All levels cover 12 core requirement domains.
SOC 1 (SSAE 18)	AICPA	US-originated, used globally	Attestation	Reports on controls relevant to a service organisation's impact on user entities' financial reporting.
SOC 2	AICPA	Global	Attestation	Reports against the Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy); Type I (design) or Type II (operating effectiveness).
SOC 3	AICPA	Global	Attestation (public)	General-use summary version of a SOC 2 report, suitable for public distribution and marketing.
SWIFT Customer Security Programme (CSP)	SWIFT	Global, financial messaging	Contractual (SWIFT members)	Mandatory security baseline and annual self-attestation for institutions using the SWIFT messaging network.

Section F: Applicability by Sector

No organisation needs every entry in Sections A-E. The matrix below highlights the standards and frameworks most commonly required in five sectors CyberCQR regularly advises on. It is a starting point for scoping a compliance programme, not an exhaustive mapping.

Sector	UK	EU	USA	International / Canada
Cloud & Technology Providers	Cyber Essentials Plus; NCSC Cloud Security Principles	Cyber Resilience Act; NIS2	FedRAMP; StateRAMP	ISO 27017/27018; CSA STAR/CCM; SOC 2
Critical National Infrastructure / Energy	NCSC CAF; NIS Regulations 2018	NIS2 Directive	NERC CIP	ISO 27001; CIS Controls
Defence & Government	MOD JSP 440/604; Def Stan 05-138/139; List X; DCPP; GSCP; GovAssure; MCSS	National defence remains sovereign; NIS2 applies to defence-adjacent CNI	CMMC 2.0; DFARS 252.204-7012; DISA STIGs; NIST SP 800-171/53; FISMA	CCCS ITSG-33 (Canada); ISO 27001
Financial Services	FCA SYSC & Operational Resilience; PRA SS2/21; Bank of England CBEST; UK MiFID II	DORA; PSD2; EBA ICT Risk Guidelines; ECB CROE	GLBA Safeguards Rule; SOX s.404; FFIEC CAT; SEC Cyber Disclosure Rule	PCI DSS; ISO 27001; SWIFT CSP
Healthcare	NHS Data Security and Protection Toolkit; UK GDPR	GDPR; NIS2 (health as an essential entity)	HIPAA Security Rule	ISO 27001; ISO 27799

Section G: Type Classifications and the Governance-to-Technical Integration Model

Every table in Sections A-F carries a colour-coded Type column, and that colour coding uses a recurring, but not always self-explanatory, set of labels -- Statutory, Mandatory, Contractual, Certification, Attestation, Accreditation, Voluntary framework, and a handful of others. The table below defines each one and gives its colour key; the sections that follow work through a concrete example of how a certification-type standard and a voluntary-framework-type standard interact in practice and set out the five-step process for combining governance and technical layers operationally.

G.1 Type Classifications Used in This Catalogue

The table is numbered by binding strength, from the most legally forceful (Statutory) to material that is reference-only and not a compliance target in its own right (row 10).

#	Type Label(s)	What It Means	How It's Assessed / Enforced
1	Statutory (incl. federal / state / provincial / transposed nationally)	Set out directly in law -- an Act of Parliament, an EU Regulation or Directive, or equivalent primary legislation. Applies to everyone within scope regardless of contract or choice.	Enforced by government regulators or the courts; penalties are usually fixed in the legislation itself, e.g. GDPR's fines of up to 4% of global turnover.
2	Mandatory (government / sector / contract-specific)	Compulsory within a defined context -- a government supplier panel, an NHS contract, a specific regulator's rulebook -- without being primary legislation.	Enforced by the body that set the requirement (a department, regulator or customer); losing compliance typically means losing the contract or authorisation, not a court penalty.
3	Mandatory accreditation	Formal government or sector-authority approval to operate in a defined trust context, such as List X or the Controlled Goods Program, usually combining physical and personnel vetting with technical controls.	Granted and revocable by the accrediting authority; losing accreditation typically ends the ability to hold the relevant contracts.
4	Contractual	Written into a specific commercial agreement or membership scheme -- SWIFT, card scheme rules, defence supply contracts -- rather than general law.	Enforced by the counterparty; non-compliance is a breach of contract, which can mean suspension or termination of the agreement or membership.
5	Certification	A named standard an organisation can be formally certified against by an accredited, independent third party, such as ISO/IEC 27001 or Cyber Essentials Plus.	Produces a dated certificate with a defined validity period, surveillance audits and a renewal cycle; the certificate itself is the evidence of compliance.
6	Attestation	An independent assessor's report describing an organisation's controls and how effectively they operated over a period, such as a SOC 1, 2 or 3 report, rather than a pass/fail certificate.	The report itself is the evidence, typically shared with customers or auditors under NDA rather than published as a public certificate.
7	Regulatory guidance / expectation / supervisory expectation	Published by a regulator or supervisor to set out what it expects of the firms it already supervises -- FCA guidance, the ECB's CROE, PRA supervisory statements -- without being a standalone law.	Referenced directly in supervisory reviews and examinations; not independently certifiable, but firms are expected to demonstrate alignment on request.
8	Collaborative scheme	Jointly run by government and industry to define and share practice across a supply chain, such as the Defence Cyber Protection Partnership.	Participation is expected of suppliers within scope rather than legally compelled; enforced in practice through procurement relationships.
9	Voluntary framework / Guidance	Not compulsory by default anywhere, but widely adopted as best practice, such as NIST CSF, the CIS Controls, or the NCSC's 10 Steps.	Self-assessed unless a regulator or customer separately chooses to mandate it; there is no external certifying body for the framework itself.
10	Governance body / Knowledge base / Maturity model / Control framework	Reference material rather than a compliance target in its own right: a coordinating body (ENISA), a catalogue of adversary techniques (MITRE ATT&CK), a self-improvement model (OWASP SAMM), or a cross-mapped control catalogue (CSA CCM).	Not something an organisation is compliant with directly; other frameworks and certifications in this catalogue draw on it as a reference.

G.2 Worked Example: CIS Benchmarks vs ISO/IEC 27001

ISO/IEC 27001 is a Certification-type standard: a management system standard, certifiable by an accredited third party, reassessed on a three-year cycle with annual surveillance audits. Its Annex A controls are deliberately written as outcomes rather than settings -- access to information shall be restricted in accordance with the access control policy says nothing about password length, MFA method or session timeout. The organisation's own risk assessment and Statement of Applicability decide which controls apply and how rigorously, which is what makes it portable across any industry or technology stack.

CIS Benchmarks are a Voluntary framework / Guidance-type standard, and a very different kind of document. They are free, vendor-published, and specific to one operating system, platform or application version -- there is a separate benchmark for Windows Server 2022, Ubuntu 22.04, and each major cloud provider's configuration surface. Each item is a testable, binary check: a specific registry value, a specific line in sshd_config, a specific password-age setting. There is no certification body; compliance is measured by automated scanning tools such as CIS-CAT against the exact benchmark version matching the deployed software and reported as a percentage score.

The two work together as requirement and implementation. An ISO 27001 Annex A control -- A.8.9 (configuration management) or A.5.15 (access control) -- establishes that systems must be securely configured and access restricted; it does not say how. The organisation's Statement of Applicability then names CIS Benchmarks (or an equivalent such as DISA STIGs) as the chosen implementation standard for that control. CIS-CAT scan results become the technical evidence an ISO 27001 auditor reviews during the management review and certification audit to confirm the control is operating effectively, not just documented. Without CIS Benchmarks, securely configured is undefined and unauditable; without ISO 27001 sitting above it, CIS Benchmark compliance has no governance context -- nobody has decided which systems matter most, so remediation effort has no order of priority.

G.3 The Five-Step Integration Model

Bridging a Certification- or Statutory-type governance standard with a Voluntary-framework-type technical standard, in practice, follows a repeatable cycle:

1. Establish the governance foundation -- the CISO and leadership select a baseline (ISO 27001, NIST CSF) aligned to legal, contractual and regulatory demands, and write the resulting policies (access control, vulnerability management, and so on).
2. Map policy to technical baseline -- security architects translate each abstract policy requirement into a named technical standard, e.g. the Access Control Policy's MFA requirement maps to CIS Control 6 or the Cyber Essentials technical requirements.
3. Deploy prescriptive hardening -- engineers apply CIS Benchmark or DISA STIG configuration scripts across operating systems, cloud tenants and network devices; developers build OWASP ASVS checks into CI/CD pipelines.
4. Automate verification -- vulnerability scanners and configuration-compliance tools test systems directly against the prescriptive standard, producing an objective pass/fail or percentage score.
5. Feed evidence back to governance -- the resulting technical compliance data is aggregated into governance artefacts (the ISO 27001 management review, a NIST CSF risk register) as verifiable proof of operational effectiveness for auditors, the board and regulators.

STRATEGIC GOVERNANCE LAYER

ISO/IEC 27001, NIST CSF, SOC 2, DORA, NIS2 -- defines risk appetite and policy outcomes. Answers: what must be controlled?

↓

TACTICAL TECHNICAL LAYER

CIS Benchmarks, DISA STIGs, Cyber Essentials, OWASP ASVS -- defines exact configuration values and pass/fail checks. Answers: how is this asset configured to comply?

↓

VERIFICATION & CONTINUOUS AUDIT

Automated scans and technical evidence feed back into governance dashboards, proving operational effectiveness to auditors, boards and regulators.

Treating these as competing choices -- do we do ISO 27001 or CIS Benchmarks? -- is a category error; they answer different questions and neither substitutes for the other. The combination is what delivers both regulatory compliance and a measurable, defensible security posture.

Closing Note: A Living Compliance Landscape

No single framework covers every obligation an organisation will face. Most compliance programmes combine a jurisdictional baseline, a sector-specific overlay, and one or more assurance certifications chosen to satisfy customer and regulator expectations. Reviewing this catalogue alongside related governance and security architecture work will help translate individual framework requirements into a coherent security programme rather than a checklist exercise.

Glossary

Term	Definition
ABAC	Attribute-Based Access Control
AIMS	AI Management System (ISO/IEC 42001)
API	Application Programming Interface
ASV	Approved Scanning Vendor (PCI DSS)
ASVS	Application Security Verification Standard (OWASP)
CAF	Cyber Assessment Framework (NCSC)
CCM	Cloud Controls Matrix (Cloud Security Alliance)
CGP	Controlled Goods Program (Canada)
CJIS	Criminal Justice Information Services (FBI)
CMMC	Cybersecurity Maturity Model Certification (US DoD)
CNI	Critical National Infrastructure
COBIT	Control Objectives for Information and Related Technologies (ISACA)
CPRA	California Privacy Rights Act
CRA	Cyber Resilience Act (EU)
CSA	Cloud Security Alliance
CUI	Controlled Unclassified Information (US)
DCPP	Defence Cyber Protection Partnership (UK MOD)
DFARS	Defense Federal Acquisition Regulation Supplement (US)
DISA	Defense Information Systems Agency (US)
DORA	Digital Operational Resilience Act (EU)
DPIA	Data Protection Impact Assessment
DSPT	Data Security and Protection Toolkit (NHS)
eIDAS	electronic IDentification, Authentication and trust Services (EU)
ENISA	European Union Agency for Cybersecurity
FCA	Financial Conduct Authority (UK)
FedRAMP	Federal Risk and Authorization Management Program (US)
FFIEC	Federal Financial Institutions Examination Council (US)
FISMA	Federal Information Security Modernization Act (US)
GDPR	General Data Protection Regulation (EU/UK)
GLBA	Gramm-Leach-Bliley Act (US)
GSCP	Government Security Classifications Policy (UK)
HIPAA	Health Insurance Portability and Accountability Act (US)
IASME	Information Assurance for Small and Medium Enterprises
ICO	Information Commissioner's Office (UK)
ISMS	Information Security Management System
ITSG-33	IT Security Guidance 33 (Canadian Centre for Cyber Security)
List X	UK accreditation for sites holding SECRET-classified MOD contract material
MCSS	Minimum Cyber Security Standard (UK Government)
MiFID II	Markets in Financial Instruments Directive II (EU/UK)
MOD	Ministry of Defence (UK)
NERC CIP	North American Electric Reliability Corporation Critical Infrastructure Protection standards
NIS	Network and Information Systems (Directive/Regulations)
NIST	National Institute of Standards and Technology (US)
NYDFS	New York State Department of Financial Services
OSFI	Office of the Superintendent of Financial Institutions (Canada)
OWASP	Open Web Application Security Project
PCI DSS	Payment Card Industry Data Security Standard
PIMS	Privacy Information Management System (ISO/IEC 27701)
PIPEDA	Personal Information Protection and Electronic Documents Act (Canada)
PRA	Prudential Regulation Authority (UK)
PSD2	Revised Payment Services Directive (EU)
PSTI Act	Product Security and Telecommunications Infrastructure Act 2022 (UK)
QSA	Qualified Security Assessor (PCI DSS)
RBAC	Role-Based Access Control
RMF	Risk Management Framework (NIST SP 800-37)
RoC	Report on Compliance (PCI DSS)
SAMM	Software Assurance Maturity Model (OWASP)
SCA	Strong Customer Authentication (PSD2)
SOC	System and Organisation Controls (AICPA)
SOX	Sarbanes-Oxley Act (US)
STIG	Security Technical Implementation Guide (DISA)
SWIFT CSP	SWIFT Customer Security Programme

References

Each numbered reference below is the jump target for the linked standard names in Sections A-E; clicking a standard's name in any table returns here. Each reference gives the owning or governing body's primary web presence as a clickable URL; individual standard documents, where publicly available, are linked from these pages.

1. Bank of England / FCA / PRA. https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide

2. NCSC / IASME. https://iasme.co.uk/cyber-essentials/

3. MOD / Defence Standardisation. https://www.dstan.mod.uk/

4. MOD & industry partners. https://www.gov.uk/government/groups/defence-cyber-protection-partnership

5. Financial Conduct Authority. https://www.fca.org.uk/

6. FCA & PRA. https://www.bankofengland.co.uk/prudential-regulation

7. Cabinet Office / NCSC. https://www.ncsc.gov.uk/

8. Cabinet Office. https://www.gov.uk/government/organisations/cabinet-office

9. Information Commissioner's Office. https://ico.org.uk/

10. MOD / Defence Business Services. https://www.gov.uk/government/organisations/ministry-of-defence

11. Ministry of Defence. https://www.gov.uk/government/organisations/ministry-of-defence

12. NCSC. https://www.ncsc.gov.uk/