The library
21 frameworks, one set of controls.
Every framework in ProofTrail maps its requirements onto the same controls, so evidence for one counts toward the others. Each page lists a framework’s requirements and the controls behind them, as they ship with ProofTrail.
CCPA
The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents, including employees and business contacts, rights over the…
- CCPA · 83 requirements
CIS Controls
The CIS Critical Security Controls, published by the Center for Internet Security, are a prioritized set of defensive practices drawn from how real attacks succeed. Version 8.1…
- CIS Critical Security Controls · 171 requirements
CMMC
CMMC Level 1 is the entry level of the US Department of Defense Cybersecurity Maturity Model Certification program. It covers Federal Contract Information (FCI) and requires the 15…
- CMMC Level 1 · 21 requirements
- CMMC Level 2 · 124 requirements
CSA STAR
CSA STAR is the Cloud Security Alliance assurance program for cloud services, and it is built on the Cloud Controls Matrix (CCM). The matrix groups cloud-specific security and…
- CSA STAR · 224 requirements
Cyber Essentials
Cyber Essentials is the UK government-backed certification scheme, run by the National Cyber Security Centre, that sets a baseline of technical controls against the most common…
- Cyber Essentials · 47 requirements
DORA
The Digital Operational Resilience Act is the EU regulation that gives banks, insurers, investment firms, payment, e-money and crypto-asset service providers and other financial…
- DORA · 122 requirements
DPDP
India's Digital Personal Data Protection Act, 2023 governs how organizations, called Data Fiduciaries, process the digital personal data of individuals in India, and of anyone they…
- DPDP · 53 requirements
FCRA
The Fair Credit Reporting Act is the US federal law that governs consumer reports, such as credit reports and employment background checks, and the agencies that prepare them. This…
- FCRA · 33 requirements
GDPR
The General Data Protection Regulation (GDPR) is the EU law that governs how personal data about people in the European Union is collected, used, stored and shared. It sets…
- GDPR · 54 requirements
HIPAA
HIPAA is the US federal law that protects health information, and this framework covers its Security Rule and Breach Notification Rule. The Security Rule requires administrative,…
- HIPAA · 78 requirements
ISO 27001:2022
ISO/IEC 27001 is the international standard for running an information security management system (ISMS). Clauses 4 to 10 set the management system requirements, such as scope,…
- ISO 27001:2022 · 131 requirements
ISO 27017:2026
ISO/IEC 27017 is the code of practice for information security in cloud services. It takes every ISO/IEC 27002:2022 control and adds guidance for cloud service customers and…
- ISO 27017:2026 · 101 requirements
ISO 27018:2025
ISO/IEC 27018 is the code of practice for protecting personally identifiable information (PII) in public cloud services where the provider acts as a PII processor. It applies the…
- ISO 27018:2025 · 131 requirements
ISO 27701:2025
ISO/IEC 27701 specifies a privacy information management system (PIMS). Since the 2025 edition it is a standalone management system standard that no longer requires ISO/IEC…
- ISO 27701:2025 · 128 requirements
ISO 42001:2023
ISO/IEC 42001 specifies requirements for an artificial intelligence management system (AIMS) for organizations that develop, provide or use AI systems. Clauses 4 to 10 cover…
- ISO 42001:2023 · 90 requirements
Microsoft SSPA
Microsoft's Supplier Security & Privacy Assurance (SSPA) program sets the privacy, security and AI requirements for suppliers that process Microsoft personal or confidential data…
- Microsoft SSPA · 74 requirements
NIST CSF
The NIST Cybersecurity Framework (CSF) 2.0 is voluntary guidance from the US National Institute of Standards and Technology for managing cybersecurity risk. It describes the…
- NIST CSF 2.0 · 134 requirements
PCI DSS
PCI DSS is the security standard the payment card brands require from every organization that stores, processes or transmits cardholder data, or that can affect the security of…
- PCI DSS · 366 requirements
PIPEDA
The Personal Information Protection and Electronic Documents Act is Canada's federal privacy law for the private sector. It applies to personal information that organizations…
- PIPEDA · 62 requirements
SOC 2
The Availability category is an optional SOC 2 add-on to the Security criteria that covers keeping systems up and usable as promised to customers. It looks at capacity planning,…
- SOC 2 Availability · 4 requirements
- SOC 2 Confidentiality · 3 requirements
- SOC 2 Privacy · 27 requirements
- SOC 2 Processing Integrity · 6 requirements
- SOC 2 Security · 42 requirements
TISAX
TISAX (Trusted Information Security Assessment Exchange) is the automotive industry's assessment and exchange mechanism, run by the ENX Association, for showing partners that…
- TISAX · 110 requirements