Your regulator is data, not a rebuild

Information Security Management

The management-system standard most groups use as their anchor, and the one most other frameworks map cleanly onto. A sensible choice for the primary standard on a shared control. ISO/IEC 27017 and 27018 sit beside it in the library for cloud and personal-data extensions.

Cybersecurity Framework

Six functions that summarise posture for a board without cutting the thread back to the controls and evidence that produced the number. The NIST Privacy Framework is held alongside it.

Security and Privacy Controls, Rev. 5

The granular catalogue other frameworks cross-reference. Twenty families import as domains with enhancements beneath, and plans of action are findings rather than a separate tracker.

Payment Card Industry Data Security Standard v4

Twelve requirements with an assessor at the end. Cardholder-data scope is a set of classified assets, evidence is reviewed before a requirement reads as met, and service providers live in the vendor register.

Cloud Controls Matrix v4

A mapping framework in a mapping library: the CCM's own cross-references are held as graded mappings, shared responsibility is recorded per control, and cloud providers are assessed in the third-party module.

General Data Protection Regulation

Data-protection obligations held as controls in the same library and mapped to the security controls that already satisfy them, rather than run as a separate programme. Any other privacy regime is loaded the same way.