Which compliance framework do I need?

SOC 2

An examination of the suitability of design and operating effectiveness of controls at a service organization relevant to security, availability, processing integrity, confidentiality or privacy (AICPA 2017 TSC, ¶.11).

• Who it applies to / typical trigger: Service organizations whose customers (“user entities”) need assurance over those controls. AICPA (Journal of Accountancy, Feb 2026): SOC reports “provide independent assurance to the service organization's customers, aka user entities”. No official source says US enterprises require SOC 2 — customers may ask for a SOC 2 report.
• Region: US origin (AICPA), used internationally
• Industry: Any service organization (SaaS, cloud, payroll, etc.)
• Law vs voluntary standard: Voluntary attestation (CPA examination); not a law
• Key official dates: None (no statutory deadline)

Official source: Archived AICPA 2017 TSC (March 2020 update) · AICPA TSC 2022 revision (login) · Journal of Accountancy, Feb 2026 · SOC 2 hub · Listings tagged SOC 2 (mechanical order, not a ranking) · Auditors

Tagged listings (first 8, A–Z): 6clicks Hailey AI, Akitra Andromeda AI compliance agents, Andesite Human-AI SOC (Azimuth for Government), Appian Agent Studio (AI agents), Comp AI, Complyance GRC AI Agents, Conveyor, Cypago Agentic Workflows · 29 more on the hub

ISO/IEC 27001

The world's best-known standard for information security management systems (ISMS). It defines requirements an ISMS must meet.

• Who it applies to / typical trigger: Companies of any size and from all sectors. Certification is optional: companies implementing ISO/IEC 27001 can decide whether they want to go through a certification process.
• Region: International
• Industry: All sectors
• Law vs voluntary standard: Voluntary standard; certification by an independent certification body
• Key official dates: Current edition: ISO/IEC 27001:2022 (published 2022-10), with Amd 1:2024. ANAB AR 28 says the IAF MD 26 transition deadline was 2025-10-31, and ISO/IEC 27001:2013 certifications expired then.

Official source: ISO/IEC 27001 · ANAB AR 28 · ISO/IEC 27001 hub · Listings tagged ISO/IEC 27001 (mechanical order, not a ranking) · Auditors

Tagged listings (first 8, A–Z): 6clicks Hailey AI, Akitra Andromeda AI compliance agents, Andesite Human-AI SOC (Azimuth for Government), Anecdotes Agentic GRC (Agent Library and Agent Studio), Appian Agent Studio (AI agents), Athereon LAiKA (AI agent for ISMS, risk and questionnaires), BigID (incl. AgentIQ agents), CITSmart GRC.S (GRC + SecOps platform with AI agents that check deadlines and execute response actions) · 37 more on the hub

ISO/IEC 42001

Specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS). ISO calls it “the world's first AI management system standard”.

• Who it applies to / typical trigger: Organizations of any size involved in developing, providing, or using AI-based products or services, across all industries, public sector included.
• Region: International
• Industry: AI developers, providers and users (all industries)
• Law vs voluntary standard: Voluntary management-system standard
• Key official dates: Published 2023-12 (Edition 1)

Official source: ISO/IEC 42001 · Auditors

HIPAA

The HIPAA Rules apply to covered entities and business associates.

• Who it applies to / typical trigger: Covered entities: health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with an HHS-standard transaction. Business associates: a person or organization that performs functions for a covered entity involving creating, receiving, maintaining or transmitting PHI. HHS examples include a cloud service provider handling ePHI and a third-party AI chatbot on a provider's patient portal. If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules.
• Region: US
• Industry: Healthcare and its vendors
• Law vs voluntary standard: US federal law/regulation (mandatory if in scope)
• Key official dates: No new deadline published on the pages checked 20 Oct 2026

Official source: HHS covered entities · HHS business associates · HIPAA hub · Listings tagged HIPAA (mechanical order, not a ranking) · Auditors

Tagged listings (first 8, A–Z): 6clicks Hailey AI, Akitra Andromeda AI compliance agents, Andesite Human-AI SOC (Azimuth for Government), Anecdotes Agentic GRC (Agent Library and Agent Studio), Appian Agent Studio (AI agents), BigID (incl. AgentIQ agents), CITSmart GRC.S (GRC + SecOps platform with AI agents that check deadlines and execute response actions), Comp AI · 16 more on the hub

PCI DSS

PCI DSS provides a baseline of technical and operational requirements designed to protect payment account data.

• Who it applies to / typical trigger: Entities that store, process, or transmit cardholder data (CHD) and/or sensitive authentication data (SAD) or could impact the security of the cardholder data environment (CDE). This includes merchants, processors, acquirers, issuers, and service providers.
• Region: Global
• Industry: Payments / anyone handling card data
• Law vs voluntary standard: Industry standard from PCI SSC (contractual through the card brands). Not a government law.
• Key official dates: PCI DSS v4.0 retired 31 Dec 2024, so v4.0.1 is the only active version. The new requirements took effect 31 Mar 2025; v4.0.1 does not impact the effective date. v4.0.1 has no new or deleted requirements.

Official source: PCI SSC — PCI DSS · PCI DSS v4.0.1 published · Auditors

GDPR

The EU's general data protection regulation (Regulation (EU) 2016/679).

• Who it applies to / typical trigger: The European Commission says the GDPR applies to (a) an entity processing personal data in the activities of an EU establishment, regardless of where the data is processed, or (b) a company established outside the EU that is offering goods/services (paid or for free) or is monitoring the behaviour of individuals in the EU.
• Region: EU/EEA, with reach outside the EU
• Industry: All sectors
• Law vs voluntary standard: EU regulation (mandatory if in scope)
• Key official dates: Entered into force 24 May 2016; applies since 25 May 2018

Official source: European Commission — application of the GDPR · EU data-protection legal framework · Auditors

India DPDP Act, 2023 + DPDP Rules, 2025

PIB: The DPDP Act establishes a comprehensive framework for protecting digital personal data, setting out the obligations of entities handling such data (Data Fiduciaries) and the rights and duties of individuals (Data Principals).

• Who it applies to / typical trigger: Data Fiduciaries handling digital personal data. Significant Data Fiduciaries have extra duties (independent audits, impact assessments). Rights requests must be answered within 90 days. Consent Managers must be Indian companies.
• Region: India
• Industry: All sectors
• Law vs voluntary standard: Indian law (mandatory if in scope)
• Key official dates: Act enacted by Parliament 11 Aug 2023. Rules notified, with the PIB release dated 14 Nov 2025 and an 18-month phased compliance timeline. See the existing DPDP checklist for the MeitY Rules PDF timeline the site already cites.

Official source: PIB release on DPDP Rules (14 Nov 2025) · India DPDP Act, 2023 + DPDP Rules, 2025 hub · Listings tagged India DPDP Act, 2023 + DPDP Rules, 2025 (mechanical order, not a ranking) · Auditors

Tagged listings (first 8, A–Z): BigID (incl. AgentIQ agents), Crest TPRM AI agents (Vendor Outreach, Questionnaire Intelligence, Continuous Monitoring, Risk-Based Scoring, Finance, Screening and Efficiency agents), Data Adhikaar DPDPA agents (ten-agent compliance fabric), IDfy AI Agents, IndiSec DPDPA compliance agents (Veda AI privacy analyst), OneTrust, OnFinance AI Maxwell (open-source cybersecurity and compliance agent for Indian BFSI), Signzy Agentic CKYC · 2 more on the hub

CERT-In Directions

Directions on information security practices, procedure, prevention, response and reporting of cyber incidents for Safe & Trusted Internet (s.70B(6) IT Act 2000, dated 28.04.2022).

• Who it applies to / typical trigger: Service providers, intermediaries, data centres, body corporate and Government organisations. Report listed cyber incidents to CERT-In within 6 hours. Keep ICT logs for a rolling 180 days within India. Sync clocks to NIC/NPL NTP servers. Data centres and VPS, cloud and VPN providers must register and keep subscriber information for 5 years.
• Region: India
• Industry: All (with extra duties for DC/VPS/cloud/VPN)
• Law vs voluntary standard: Legally binding direction under the IT Act (mandatory if in scope)
• Key official dates: Effective after 60 days from the date on which it is issued (issued 28.04.2022)

Official source: CERT-In Directions PDF · CERT-In Directions page · CERT-In Directions hub · Listings tagged CERT-In Directions (mechanical order, not a ranking) · Auditors

Tagged listings (first 8, A–Z): OnFinance AI Maxwell (open-source cybersecurity and compliance agent for Indian BFSI)

FedRAMP

FedRAMP was established in the law to provide a standardized approach to the assessment and authorization of cloud computing products and services that process unclassified information used by agencies.

• Who it applies to / typical trigger: Cloud service providers selling to US federal agencies. Federal agencies must ensure that any cloud service they use has a FedRAMP Certification if their use is within the scope of FedRAMP. For state or local buyers, also see GovRAMP and TX-RAMP.
• Region: US federal
• Industry: Government cloud
• Law vs voluntary standard: US federal program (required for in-scope agency cloud use)
• Key official dates: FedRAMP.gov shows Total FedRAMP Certified Services: 544 and FedRAMP 20x Certified Services: 32 (as of 20 Oct 2026). 2026 Consolidated Rules are in force.

Official source: FedRAMP 2026 scope · Agency responsibilities · FedRAMP.gov · FedRAMP hub · Listings tagged FedRAMP (mechanical order, not a ranking) · Auditors

Tagged listings (first 8, A–Z): Abnormal AI Security Mailbox (Abnormal AI for Government), Agentforce for Public Sector, Andesite Human-AI SOC (Azimuth for Government), Anecdotes Agentic GRC (Agent Library and Agent Studio), Appian Agent Studio (AI agents), Box AI Agents (Box Agent, Extract, Classification and custom agents; Box for Government), Cav Compliance OS agents (formerly Caveonix), Drata · 11 more on the hub

CMMC

Department of War program that assesses compliance with cybersecurity standards at progressively advanced levels, depending on the type and sensitivity of the FCI or CUI.

• Who it applies to / typical trigger: DoW contractors and subcontractors entrusted with FCI or CUI must achieve a specific CMMC level as a condition of contract award. Level 1: annual self-assessment against the 15 FAR 52.204-21 requirements. Level 2: self-assessment every 3 years against the 110 NIST SP 800-171 Rev 2 requirements, with annual affirmation.
• Region: US
• Industry: Defense industrial base
• Law vs voluntary standard: US contractual/regulatory requirement (DFARS)
• Key official dates: Phase 1 began 10 Nov 2025. On 13 Jul 2026 DoW announced the immediate suspension of the CMMC Phase II requirements, which was originally scheduled for November 10, 2026. All Phase I self-assessment requirements remain firmly in place. Phase II is suspended; do not treat 10 Nov 2026 as a start date.

Official source: DoD CIO — CMMC About · CMMC hub · Listings tagged CMMC (mechanical order, not a ranking) · Auditors

Tagged listings (first 8, A–Z): 6clicks Hailey AI, Akitra Andromeda AI compliance agents, Complyance GRC AI Agents, Cypago Agentic Workflows, Drata, IntelliGRC Evan and Alfie AI agents, RegScale RegML AI agents (RegScale CCM), Secureframe · 2 more on the hub

DORA

EU regulation to strengthen the digital resilience of financial entities (Regulation (EU) 2022/2554).

• Who it applies to / typical trigger: Applicable to 20 different types of financial entities and ICT third-party service providers: banks, insurance companies, investment firms and others.
• Region: EU
• Industry: Financial services and their ICT providers
• Law vs voluntary standard: EU regulation (mandatory if in scope)
• Key official dates: Applies from 17 Jan 2025 (entered into application on 17 Jan 2025)

Official source: EIOPA — DORA · DORA hub · Listings tagged DORA (mechanical order, not a ranking) · Auditors

Tagged listings (first 8, A–Z): 6clicks Hailey AI, AIpentix (agentic continuous security testing and agentic red teaming, by Swipergy), BRYTER Hybrid Agents (AI plus rule-based workflow agents for DORA, DPA and NDA contract review), Cloudgeni cloud agents (Compliance Remediation, Drift & Import, PR Review and other infrastructure agents), Co-Brain Questionnaire Agent (security questionnaire automation), Covasant TPRM (agentic third-party risk management), Crest TPRM AI agents (Vendor Outreach, Questionnaire Intelligence, Continuous Monitoring, Risk-Based Scoring, Finance, Screening and Efficiency agents), Egerie Jerry (agentic Cyber GRC platform) · 12 more on the hub

EU AI Act

The first-ever comprehensive legal framework on AI worldwide. It sets risk-based rules for AI developers and deployers (Regulation (EU) 2024/1689).

• Who it applies to / typical trigger: AI developers (providers) and deployers, under risk-based obligations.
• Region: EU
• Industry: All sectors using or building AI
• Law vs voluntary standard: EU regulation (mandatory if in scope)
• Key official dates: Entered into force 1 Aug 2024. Prohibited practices and AI literacy obligations apply from 2 Feb 2025. GPAI and governance rules from 2 Aug 2025. Generally applicable since 2 Aug 2026. The “AI Omnibus” entered into force 27 Jul 2026: Annex III high-risk rules apply from 2 Dec 2027 and Annex I (regulated products) from 2 Aug 2028.

Official source: European Commission — AI Act · Auditors

NIS2 Directive

Establishes a unified legal framework to uphold cybersecurity in 18 critical sectors across the EU (Directive (EU) 2022/2555).

• Who it applies to / typical trigger: Introduces a clear size threshold rule — meaning that all medium and large-sized companies in selected sectors will be included in the scope. Entities are classed as essential or important. For credit institutions and similar entities, DORA applies for cybersecurity risk management and reporting.
• Region: EU (national transposition)
• Industry: 18 critical sectors
• Law vs voluntary standard: EU directive, applied through national laws (mandatory if in scope)
• Key official dates: Member States had to transpose by 17 Oct 2024. First Commission review due by 17 Oct 2027.

Official source: European Commission — NIS2 · NIS2 FAQs · Auditors