38 schemes, with the three things people actually need to compare: how the obligation arises, who performs the assessment, and what you are left holding at the end. Several of these produce no certificate at all, which surprises most buyers.
Region
How it applies
Showing 38 of 38
| Framework | Region | How it applies | Assessed by | What you get |
|---|---|---|---|---|
| CCPA and CPRA | US | Law | No certification. Enforced by the California Privacy Protection Agency | Demonstrable compliance, not a certificate |
| CIS Critical Security Controls | Global | Voluntary | Self-assessment. No certification exists | A prioritised control posture, not a certificate |
| CJIS Security Policy | US | Law | The state CJIS Systems Agency | Authorisation to handle criminal justice information |
| CMMC | US | Contract | Self-assessment at Level 1, a C3PAO at Level 2 | A certification tied to contract eligibility |
| Cyber Essentials | UK | Contract | Self-assessment, verified by an IASME certification body | Annual certificate |
| Cyber Essentials Plus | UK | Contract | Hands-on technical audit by an IASME certification body | Annual certificate |
| Digital Operational Resilience Act | EU | Law | Your national competent authority | Supervised compliance, not a certificate |
| EU AI Act | EU | Law | Conformity assessment, self or notified body by risk class | CE marking and EU database registration for high-risk systems |
| EU Cyber Resilience Act | EU | Law | Conformity assessment, self or notified body by product class | CE marking, and reporting obligations that already apply |
| FCA Operational Resilience | UK | Law | The FCA, through supervision rather than certification | Evidenced impact tolerances, board-approved and tested |
| FedRAMP | US | Contract | A FedRAMP-accredited 3PAO | An authorisation listed on the FedRAMP Marketplace |
| GovAssure | UK | Contract | Independent review, coordinated by the Cabinet Office | An assured CAF profile for the department |
| GovRAMP | US | Contract | Third-party assessment organisation | A status recognised across participating states |
| HIPAA | US | Law | No certification. Enforced by HHS Office for Civil Rights | Demonstrable safeguards, not a certificate |
| HITRUST CSF | US | Contract | HITRUST-authorised external assessor | e1, i1 or r2 certification |
| IASME Cyber Assurance | UK | Voluntary | IASME certification body | Annual certificate at Level One or Level Two |
| ISO 22301 | Global | Voluntary | Accredited certification body | Three-year certificate with annual surveillance audits |
| ISO 27001 | Global | Voluntary | UKAS-accredited certification body | Three-year certificate with annual surveillance audits |
| ISO 27017 | Global | Voluntary | Accredited certification body, alongside ISO 27001 | Certificate covering cloud-specific controls |
| ISO 27018 | Global | Voluntary | Accredited certification body, alongside ISO 27001 | Certificate covering PII handling as a cloud processor |
| ISO 27701 | Global | Voluntary | Accredited certification body | Certificate. Standalone since the 2025 edition |
| ISO 42001 | Global | Voluntary | Accredited certification body | Certificate for an AI management system |
| LFPDPPP | Mexico | Law | Secretaria Anticorrupcion y Buen Gobierno | Demonstrable compliance, not a certificate |
| LGPD | Brazil | Law | Autoridade Nacional de Protecao de Dados | Demonstrable compliance, not a certificate |
| NCSC Cyber Assessment Framework | UK | Law | The relevant competent authority for your sector | An assessed profile against 14 principles, not a certificate |
| NHS Data Security and Protection Toolkit | UK | Contract | Annual self-assessment, with an independent CAF-aligned audit for most | A published toolkit submission status |
| NIS2 Directive | EU | Law | The national authority in each member state | Registration and ongoing supervision, not a certificate |
| NIST Cybersecurity Framework | US | Voluntary | No certification. Self-assessed or reviewed | A risk posture, expressed as tiers and profiles |
| NIST SP 800-171 | US | Contract | Self-assessment with a score filed to SPRS | An SPRS score |
| NIST SP 800-53 | US | Law | Agency authorising official | An Authority to Operate |
| PCI DSS | Global | Contract | QSA, or self-assessment questionnaire by merchant level | An Attestation of Compliance |
| Penetration Testing | Global | Contract | CREST-aligned testing team | A findings report and retest |
| PIPEDA | Canada | Law | Office of the Privacy Commissioner of Canada | Compliance with ten fair information principles |
| SOC 1 | US | Contract | Licensed CPA firm | An attestation report, Type 1 or Type 2. Not a certificate |
| SOC 2 | US | Contract | Licensed CPA firm | An attestation report, Type I or Type II. Not a certificate |
| TISAX | EU | Contract | An ENX-accredited audit provider | Labels shared on the ENX exchange, not a public certificate |
| TX-RAMP | US | Law | Texas Department of Information Resources | A TX-RAMP certification at Level 1 or Level 2 |
| UK GDPR and EU GDPR | EU | Law | No certification. Enforced by the ICO or an EU supervisory authority | Demonstrable accountability, not a certificate |