Achieve compliance requirements for infrastructure

The Secure Controls Framework (SCF) is a comprehensive catalog of controls that addresses cybersecurity, privacy, supply chain, and ESG requirements across multiple laws, regulations, and frameworks. It helps organizations build and manage their cybersecurity and privacy programs based on business needs and applicable compliance requirements.

UK Cyber Essentials is a government-backed certification scheme that helps organizations protect against common cyber threats. It defines a fundamental set of controls that organizations should implement to mitigate the risk from common internet-based threats, within the context of the 10 Steps to Cyber Security.

The Payment Card Industry Data Security Standard (PCI DSS) v4 is the latest version of the worldwide security standard for organizations that handle cardholder information. Version 4 introduces significant changes to address emerging threats and technologies, with increased focus on security as a continuous process rather than point-in-time compliance.

System and Organization Controls (SOC) 2 is an auditing procedure that ensures service providers securely manage customer data. The SOC 2 framework is based on five trust service criteria: security, availability, processing integrity, confidentiality, and privacy.

The NIST Cybersecurity Framework (CSF) v1.1 is a voluntary framework consisting of standards, guidelines, and best practices to manage cybersecurity risk. It provides a common organizing structure for multiple approaches to cybersecurity by assembling standards, guidelines, and practices that are working effectively today.

The Microsoft Cloud Security Benchmark provides prescriptive best practices and recommendations to help improve the security of workloads, data, and services across Microsoft Cloud platforms including Azure, Microsoft 365, and Dynamics 365.

The HIPAA Security Rules establish national standards for protecting electronic protected health information (ePHI) that is created, received, used, or maintained by covered entities and business associates. The Security Rules require appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information. The rules are divided into required and addressable implementation specifications, with three main safeguard categories: administrative safeguards (security management, assigned security responsibility, workforce training, etc.), physical safeguards (facility access controls, workstation security, etc.), and technical safeguards (access controls, audit controls, integrity controls, transmission security, etc.).

ISO/IEC 27001 is an international standard for managing information security. It specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS) within the context of the organization's overall business risks.

The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy in the European Union and the European Economic Area. It addresses the transfer of personal data outside the EU and EEA areas and gives individuals control over their personal data.

HITRUST CSF v11.2 is the latest version of the HITRUST Common Security Framework, providing a comprehensive approach to regulatory compliance and risk management for organizations handling sensitive information. This update refines the controls and assessment methodology from v11, incorporating feedback from industry practitioners and adapting to the evolving threat landscape. The framework harmonizes multiple industry standards and regulations including HIPAA, GDPR, NIST, ISO, PCI, and others into a single overarching framework, allowing organizations to address multiple compliance requirements through a unified assessment. HITRUST CSF v11.2 employs a risk-based approach with maturity-level scoring across its control categories, enabling organizations to demonstrate their security posture with scalable levels of assurance from self-assessment to validated assessment with certification.

The Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline is a standardized set of security requirements for cloud services used by U.S. federal government agencies. It provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. The Moderate baseline addresses data and systems where the loss of confidentiality, integrity, or availability would have a serious adverse effect on organizational operations, organizational assets, or individuals. It implements 325 controls from NIST SP 800-53.

The Center for Internet Security (CIS) AWS Foundations Benchmark serves as a set of security configuration best practices for AWS. These industry-accepted best practices provide you with clear, step-by-step implementation and assessment procedures. Ranging from operating systems to cloud services and network devices, the controls in this benchmark help you protect the specific systems that your organization uses.