Frameworks
All 38, grouped by where most companies are when the framework lands on them. Most clients end up with two or three, and because they share most of their evidence, running them as one programme costs far less than running them one at a time.
Usually triggered by a customer questionnaire or a public sector tender, and often the first time anyone has asked. These are achievable in weeks rather than quarters.
Delivered as SprintUK organisations, and a hard requirement for most central government contracts.
The same five controls as Cyber Essentials, independently tested rather than self-declared.
Smaller UK organisations wanting broader assurance than Cyber Essentials without the cost of ISO 27001.
Anyone processing the personal data of UK or EU residents, wherever they are based.
The ones procurement teams ask for by name, and the testing that backs them up. At this point compliance has stopped being admin and started deciding whether deals close.
Delivered as Sprint, then EngageTeams that want a prioritised, prescriptive place to start before committing to a certification.
Any organisation that needs to prove its information security management to customers or regulators.
Organisations wanting a structure for a security programme without a certification burden.
Required as evidence by most of the schemes above rather than a scheme in itself.
Service organisations selling to US enterprise buyers, who ask for it by name.
Added when your market, your data or your territory asks for something specific. Most of these sit alongside an existing programme rather than replacing it, and reuse its evidence.
Delivered as EngageFor-profit businesses meeting any one of the California thresholds, wherever in the world they are based.
Anyone placing an AI system on the EU market or using one whose output is used in the EU, whatever their own location.
US covered entities and their business associates handling protected health information.
Healthcare vendors whose customers treat HITRUST as the assurance bar.
Organisations that need to evidence business continuity, often because a customer contract or a regulator asks for it.
Cloud service providers and customers that want cloud-specific security controls evidenced on top of ISO 27001.
Public cloud providers acting as a processor of personal data, where customers want more than a contractual promise.
Organisations that want to evidence privacy management rather than assert it.
Organisations that develop, provide or use AI systems and need to evidence governance.
Private sector organisations handling personal data in Mexico.
Anyone processing the personal data of people in Brazil.
Any organisation with access to NHS patient data or NHS systems.
Anyone who stores, processes or transmits cardholder data.
Private sector organisations handling personal information in Canada.
Service organisations whose work affects their customers financial reporting, so their customers auditors ask for it.
Suppliers to the automotive industry, where OEMs require it before sharing prototype or confidential information.
Continuous supervision rather than an annual certificate, with a regulator or an authorising official at the end. Long programmes, and the ones where getting the scope wrong is expensive.
Delivered as FortifyAnyone touching criminal justice information, including vendors.
The US defence industrial base, by contract clause.
EU financial entities and their critical ICT providers. UK firms are caught through EU subsidiaries, branches or EU clients.
Manufacturers of any product with digital elements sold in the EU, including software sold on its own.
UK firms regulated by the FCA, and dual-regulated firms under the PRA equivalent.
Cloud service providers selling to US federal agencies.
UK central government departments and their arms-length bodies.
Cloud providers selling to US state and local government.
Operators of Essential Services under the NIS Regulations: energy, transport, water, health, digital infrastructure.
Essential and important entities across 18 EU sectors. It has no effect in the UK, where the NIS Regulations apply instead.
US defence contractors handling Controlled Unclassified Information.
US federal information systems under FISMA, and the control catalogue behind FedRAMP.
Cloud providers contracting with Texas state agencies.
Send us the questionnaire or the tender you are answering and we will tell you what it actually requires, and what it does not. Or run the selector and see for yourself.