20 frameworks, 1,812 controls
Every framework below is seeded as real control rows with owners, statuses, evidence requirements and dated evidence — not a label on a dashboard. They are crosswalked to each other, so the artefact you collect for one counts towards the next.
Each page says what is in scope and what is not. 7 of the 20 are published under a licence that prevents us shipping the control text — we say which, and link you to the publisher, rather than quietly redistributing it.
AI Governance(2)
The first management-system standard for artificial intelligence. Track an AI management system the same way you track your ISMS — policies, roles, impact assessment, life cycle, data governance, and third-party AI.
Scope: Annex A controls. Clauses 4–10 are the management-system requirements and are not modeled as controls.
GOVERN, MAP, MEASURE and MANAGE, with the verbatim public-domain subcategory text. The voluntary framework US regulators and customers increasingly ask about, tracked as real controls with evidence.
Scope: The AI RMF Core. The Generative AI Profile (NIST AI 600-1) is not included.
Security Programs(4)
The current CSF, including the GOVERN function. Used as the hub other frameworks crosswalk through, so evidence you map once counts in more than one place.
Kept for programs still reporting against 1.1 during the move to 2.0.
Scope: Legacy. New programs should start on CSF 2.0.
The 2022 Annex A control set, with evidence mapped from your connected tools and a crosswalk that carries the same evidence into ISO 42001.
Scope: Annex A controls. Clauses 4–10 are not modeled as controls.
The prioritized safeguard set, useful as a starting programme when a formal certification is not the goal.
Scope: The 153 safeguard identifiers and their 18 groups are v8.1; the v8.1 security-function mapping and Implementation Group positioning ship as a separate maturity pack.
Government & Defense(5)
The 17 foundational safeguarding practices for Federal Contract Information, mapped to FAR 52.204-21, with an annual self-assessment tracker.
All 110 practices across 14 domains, with practice-level evidence, SPRS scoring, and the official self-assessment and POA&M artifacts a C3PAO asks for by name.
All 97 Revision 3 requirements for protecting CUI in nonfederal systems, in NIST's own 03.xx.xx numbering with the verbatim requirement text and the SP 800-171A evidence lists.
Scope: Revision 3 numbering, not the CMMC practice IDs: CMMC Level 2 is still defined by the Revision 2 requirements. The 33 requirements Revision 3 withdrew are not listed.
The 24 NIST SP 800-172 enhanced requirements selected in 32 CFR 170.14(c)(4), with the rule's verbatim text, for programs that need them on top of Level 2.
The full NIST SP 800-53 Rev 5 Moderate baseline across all 19 control families, with the verbatim public-domain control text.
Audit & Attestation(4)
Trust Services Criteria tracked continuously, so the evidence for your next Type II window accumulates instead of being assembled the month before.
The v11 control set for organizations whose customers require HITRUST.
Scope: r2 baseline, Implementation Levels 1 and 2.
The VDA ISA catalog required across the automotive supply chain.
Scope: Information Security catalog. Prototype Protection and Data Protection are not included.
IT general controls — access, change management, and operations — for the technology half of a SOX programme.
Privacy & Sector Regulation(5)
The security and accountability articles, with verbatim public-domain text.
Administrative, physical and technical safeguards under 45 CFR 164, with verbatim public-domain text.
Scope: § 164.308, § 164.310 and § 164.312 only. § 164.314 (organizational requirements) and § 164.316 (policies, procedures and documentation) are not seeded.
The v4.0.1 requirements for organizations in scope for cardholder data.
Scope: ROC line-item level rather than the full sub-requirement tree.
The EU digital operational resilience requirements for financial entities and their ICT providers, with verbatim public-domain text.
23 NYCRR 500 as amended in 2023, for entities regulated by the New York Department of Financial Services.
Running something that isn’t here? Custom frameworks import from CSV on Enterprise, and your plan caps how many frameworks you run at once — never which ones. View pricing.
Ready to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.