ISO/IEC 27001:2022
ISO 27001 is an international standard for managing information security. It helps organizations protect sensitive data, identify risks, and ensure compliance through an Information Security Management System.
Security
FRAMEWORK LIBRARY
Frameworks supported by Enveedo
Explore security, artificial intelligence, and privacy frameworks supported by Enveedo. Search by name or filter by category.
Showing 64 of 64 frameworks
SOC 2 Readiness
SOC 2 is an AICPA-developed framework. It audits service providers controls across five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy, ensuring data protection.
Security
TISAX ISA
TISAX is an assessment model based on ISO 27001, tailored for the automotive industry. It supports secure data sharing among manufacturers, suppliers, and service providers, ensuring industry-aligned information security.
Security
NIST SP 800-82
NIST SP 800-82 provides guidance on securing Industrial Control Systems (ICS), including SCADA systems, DCS, and PLCs, helping organizations manage cybersecurity risks and protect operational technologies from threats.
Security
ISO/IEC 9001:2015
ISO/IEC 9001:2015 is an international standard that defines requirements for a Quality Management System, ensuring organizations deliver products and services that meet customer and regulatory needs while promoting continuous improvement.
Security
NIST CSF v2.0
The NIST Cybersecurity Framework provides guidelines for managing and reducing cybersecurity risks. It helps organizations identify, protect, detect, respond to, and recover from cyber threats, enhancing resilience and protecting critical assets.
Security
HIPAA Security Rule
HIPAA Security Rule sets standards to protect electronic personal health data. It requires safeguards—administrative, physical, and technical—to ensure confidentiality, integrity, and security of health data.
Security
ISO/IEC 27002:2022
ISO/IEC 27002 offers guidance on information security controls and serves as a practical implementation guide for ISO/IEC 27001, helping organizations select and apply controls to protect information assets.
Security
NIS2 Directive
The NIS2 Directive sets EU-wide rules to strengthen cybersecurity for critical and important entities. It establishes stricter obligations for risk management, incident reporting, and governance, as defined in Directive (EU) 2022/2555 and Implementing Regulation (EU) 2024/2690.
Security
DORA
Regulation (EU) 2022/2554 (DORA) establishes a harmonised framework to enhance the digital operational resilience of financial entities and their ICT service providers, ensuring they can withstand, respond to, and recover from ICT-related disruptions and cyber incidents.
Security
PCI DSS v4.0.1
PCI DSS v4.0.1 is a global standard for protecting credit card data. It helps organizations prevent fraud by requiring access controls, encryption, and compliance, ensuring secure cardholder data handling practices.
Security
ISO/IEC 31000:2018
ISO 31000 provides guidelines for risk management, helping organizations identify, assess, and treat risks. It integrates risk thinking into processes, improving resilience, efficiency, and informed decision-making.
Security
ISO/IEC 27017:2015 (CSC)
ISO/IEC 27017:2015 provides cloud security guidance for Cloud Service Customers. It complements ISO 27002 by detailing controls for access, data protection, and shared responsibilities in cloud environments.
Security
ENS
The National Security Framework (ENS), established by Royal Decree 311/2022, defines cybersecurity measures for public entities and providers. This self-assessment follows the ENS and the CCN-STIC 808 Guide by Spain’s National Cryptologic Center.
Security
CIS CSC V8.1
The CIS Controls are prioritized best practices to secure IT systems. Version 8.1 improves clarity and helps organizations assess and enhance their cybersecurity posture through structured guidance and risk management.
Security
ISO/IEC 22301:2019
ISO 22301 is the standard for Business Continuity Management. It helps organizations prepare for and recover from disruptions, ensuring critical business operations continue during emergencies and reducing downtime.
Security
ISO/IEC 27017:2015 (CSP)
ISO/IEC 27017:2015 offers security guidance for Cloud Service Providers. As an extension of ISO 27002, it defines controls for secure service delivery, including virtualization, monitoring, and customer data handling.
Security
NIST SP 800-171 Rev. 3
NIST SP 800-171 Rev. 3, issued in May 2024, defines security requirements to protect Controlled Unclassified Information (CUI) in nonfederal systems. This framework guides contractors and partners working with U.S. federal agencies.
Security
Política General Ciberseguridad Administración Pública Federal (México)
Establishes mandatory cybersecurity guidelines for Mexico’s federal public sector, covering governance, risk management, critical infrastructure protection, incident response, third-party security, and secure development.
Security
BCRA Comunicación "A" 8401/2026 (Argentina)
Establishes regulatory requirements for technology governance, information security, cyber risk management, operational resilience, and business continuity to strengthen the security and stability of Argentina’s financial institutions.
Security
Ley Ciberseguridad Puerto Rico
Establishes cybersecurity requirements for Puerto Rico’s government agencies, including risk management, incident response, continuous monitoring, zero-trust security, and reporting to protect public systems and infrastructure.
Security
PRITS' Act No. 75
Establishes PRITS as Puerto Rico’s central authority for government technology and innovation, defining leadership responsibilities and coordinating cybersecurity strategies, information policies, and digital transformation across public agencies.
Security
ISO/IEC 20000-1:2018
International standard for IT Service Management (ITSM), defining requirements to establish, maintain, and continuously improve service management systems, including service planning, design, delivery, transition, and assurance.
Security
NIST SP 800-53 Rev. 5
Provides a comprehensive catalog of security and privacy controls organized into 20 families, covering access management, incident response, system integrity, cyber resilience, privacy, and supply chain security.
Security
Normas de Ciberseguridad para la industria de Seguros (Regla No. 108)
Establishes mandatory cybersecurity requirements for Puerto Rico’s insurance industry, including risk-based security programs, protection of non-public information, and cybersecurity incident reporting within 72 hours.
Security
Circular Básica Jurídica (C.E. 006/25)
Colombia’s Financial Superintendence regulation covering corporate governance, risk management, cybersecurity, consumer protection, AML/CFT compliance, and operational requirements for supervised financial institutions.
Security
PCI DSS v4.0.1 (Expanded)
Comprehensive PCI DSS framework covering 280 base requirements and 512 testing procedures across payment security, access control, vulnerability management, monitoring, secure development, and data protection.
Security
PCI DSS v4.0.1 (testing procedures)
Contains the PCI DSS v4.0.1 testing procedures used to verify the implementation and effectiveness of security requirements and controls, supporting detailed compliance assessments and audit preparation.
Security
Slovenia NIS2 (ZInfV-1)
Transposes the NIS2 Directive into Slovenian law, establishing cybersecurity governance, risk management, security documentation, incident reporting, and periodic assessment requirements for essential and important entities.
Security
CyFun 2025 (Important)
Belgium’s CyberFundamentals Framework based on NIST CSF 2.0, defining 133 requirements and key measures with a minimum maturity level of 3/5 to support NIS2 cybersecurity compliance for important entities.
Security
Italy NIS2 Basic Security Measures for Important Entities (ACN Det. 164179-2025)
Defines 37 cybersecurity measures and 87 requirements based on NIST CSF 2.0, covering governance, risk management, supply chain security, access control, monitoring, incident response, and recovery for important entities.
Security
Romania NIS2 (GEO 155-2024)
Transposes NIS2 into Romanian law, requiring cybersecurity risk management, technical and organizational safeguards, incident reporting, national registration, and designated security leadership for essential and important entities.
Security
Portugal NIS2 (Decreto-Lei n.º 125 / 2025)
Establishes NIS2 cybersecurity requirements in Portugal, including risk management, security leadership, incident reporting, and technical safeguards for essential, important, and relevant public entities.
SecurityItaly NIS2 (D.Lgs. 138-2024)
Transposes NIS2 into Italian law, requiring ACN registration, cybersecurity risk management, incident reporting, designated compliance responsibilities, and regulatory oversight for essential and important entities.
Security
Croatia NIS2 (Cybersecurity Act)
Implements NIS2 cybersecurity requirements in Croatia, covering risk management, incident reporting, supply chain security, access controls, multifactor authentication, and regulatory supervision for essential and important entities.
Security
EU AI ACT
The EU AI Act is a regulatory framework that classifies AI systems by risk level and sets rules to ensure safety, transparency, human oversight, and fundamental rights protection, aiming to foster trustworthy and lawful AI across the EU.
AI
NIST AI RMF 600-1
The NIST AI Risk Management Framework helps assess and manage AI risks. It ensures AI systems are secure, ethical, transparent, and privacy-respecting while minimizing harm and supporting responsible innovation.
AI
ISO/IEC 42001:2023
ISO 42001 is an international standard for managing AI responsibly. It helps organizations create an AI Management System (AIMS), address risks, and comply with legal, ethical, and social expectations effectively.
AI
GDPR
The GDPR regulates how personal data is handled in the EU. It empowers individuals with control over their data and imposes strict responsibilities and penalties on organizations to ensure data protection.
Privacy
Enveedo PIA
Enveedo PIA identifies privacy risks in data processing. It ensures safeguards are in place, aligns with laws like GDPR, and helps organizations mitigate risks before launching new data-handling activities.
Privacy
Colombia Data Protection Law
Colombia’s Law 1581 sets privacy principles and rules for data protection. It ensures transparency, data security, and compliance obligations for entities that process personal data within the country.
Privacy
Mexico Data Protection Law (Public)
This law applies to public entities in Mexico. It protects personal data through principles like transparency and accountability, ensuring individuals can control and access their data held by government.
Privacy
Anexo 28 RMF 2024
Annex 28 of the 2024 RMF sets the technical and operational rules for submitting, storing, and validating electronic accounting before the Mexican tax authority. It defines formats, structure requirements, and digital compliance standards.
Privacy
NIST Privacy Framework v1.0
The NIST Privacy Framework helps manage privacy risks when building systems and services. It supports compliance and enables responsible data-handling practices by identifying and reducing privacy risks.
Privacy
Argentina Data Protection Law
Argentina’s Law 25,326 protects personal data and ensures individual privacy rights. It applies to both sectors and mandates that organizations process personal data under transparency and legal principles.
Privacy
Mexico Data Protection Law (Private)
Mexico’s LFPDPPP regulates how private entities process personal data. It protects privacy rights and sets rules for lawful processing, ensuring transparency, consent, and appropriate data safeguards.
Privacy
Chile Cybersecurity Law
Chile’s Cybersecurity Framework Law (21.663) requires public and private infrastructure to implement security measures, report incidents, and coordinate with national authorities to ensure cyber resilience.
Privacy
Circular CO SA 17.18/24
Circular CO SA 17.18/24 provides supervision and control guidelines for financial entities, strengthening transparency duties, risk management practices, and regulatory reporting through enhanced governance and compliance standards
Privacy
ISO/IEC 27701:2025
ISO/IEC 27701:2025 is an international standard that defines controls and guidance to establish and maintain a Privacy Information Management System (PIMS), supporting personal data management and compliance with data protection regulations.
Privacy
Chile Data Protection Law (21.719)
Chile’s new Data Protection Law (21.719) mandates transparency and consent for data use, enforces rights like access, correction, and deletion, and aligns the country with global data standards by December 2026.
Privacy
Peru Data Protection Law
Peru’s Law 29733 protects personal data by requiring consent, data security, and transparency. It ensures that individuals' privacy rights are respected in all public and private data processing activities.
Privacy
Chile Data Protection Law (No. 19628)
Chile’s Law 19.628 regulates personal data protection. Although the new Law 21.719 has been published, Law 19.628 remains in force until December 2026, continuing to govern how personal data is collected, processed, and used.
Privacy.png)
LGPD
The LGPD is Brazil’s comprehensive data law, regulating the collection and use of personal data. It applies to all organizations processing data in Brazil and guarantees rights, informed consent, and strong data protection.
Privacy
CE 007/2018 Requirements
This circular defines minimum cybersecurity requirements for financial entities in Colombia. It ensures information is protected through mandatory controls and enhances the financial sector’s cyber resilience.
Privacy
Panama Data Protection Law
Panama’s Law 81 of 2019 regulates the protection of personal data, establishing principles like consent, purpose limitation, and data security. It applies to public and private entities that process personal data within Panama.
Privacy
Costa Rica Data Protection Law
Costa Rica’s Law 8968 protects personal data through principles of consent, transparency, and proportionality. It ensures individuals' rights over their data and regulates public and private sector data processing activities.
Privacy
ISO/IEC 27701:2019 Processors
Extends ISO 27001 with privacy requirements for organizations processing personal data on behalf of controllers, covering data protection responsibilities, security controls, accountability, and compliance with privacy obligations.
Privacy
ISO/IEC 27701:2019 Controllers
Extends ISO 27001 with privacy requirements for organizations determining how personal data is processed, covering data subject rights, lawful processing, accountability, risk management, and privacy governance.
Privacy
Ley PDP Ecuador
Ecuador’s Organic Law on Personal Data Protection regulates personal data processing, establishing requirements for consent, security, accountability, and data subject rights, while defining responsibilities for controllers and processors.
Privacy
California Consumer Privacy Act (CCPA)
California’s privacy law, expanded by the CPRA, grants consumers rights to access, correct, and delete personal data, opt out of its sale or sharing, and limit sensitive data use, while imposing obligations on eligible businesses.
Privacy
PIPEDA
Canada’s federal privacy law governing how private-sector organizations handle personal information in commercial activities, emphasizing consent, accountability, security, transparency, individual access, and fair information practices.
Privacy
Ley Uruguay PDP
Uruguay’s Law No. 18.331 regulates personal data protection in public and private databases, establishing requirements for consent, security, confidentiality, and lawful processing, while granting individuals rights to access, rectify, delete, and object.
Privacy
Ley El Salvador PDP
El Salvador’s Personal Data Protection Law regulates personal data processing, requiring informed consent, sensitive data protection, data protection officers, and secure transfers, while establishing ARCO-POL rights under ACE supervision.
Privacy
Ley Paraguay PDP
Paraguay’s Law No. 6534/2020 establishes personal data protection requirements, covering consent, security, data processing, storage, and transfers, while granting individuals ARCO rights and defining organizational compliance obligations.
Privacy
No frameworks found
Try another search or select a different category.
ISO/IEC 27001:2022
ISO 27001 is an international standard for managing information security. It helps organizations protect sensitive data, identify risks, and ensure compliance through an Information Security Management System.
SOC 2 Readiness
SOC 2 is an AICPA-developed framework. It audits service providers' controls across five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy, ensuring data protection.
TISAX ISA
TISAX is an assessment model based on ISO 27001, tailored for the automotive industry. It supports secure data sharing among manufacturers, suppliers, and service providers, ensuring industry-aligned information security.
NIST SP 800-82
NIST SP 800-82 provides guidance on securing Industrial Control Systems (ICS), including SCADA systems, DCS, and PLCs, helping organizations manage cybersecurity risks and protect operational technologies from threats.
ISO/IEC 9001:2015
ISO/IEC 9001:2015 is an international standard that defines requirements for a Quality Management System, ensuring organizations deliver products and services that meet customer and regulatory needs while promoting continuous improvement.
NIST CSF v2.0
The NIST Cybersecurity Framework provides guidelines for managing and reducing cybersecurity risks. It helps organizations identify, protect, detect, respond to, and recover from cyber threats, enhancing resilience and protecting critical assets.
HIPAA Security Rule
HIPAA Security Rule sets standards to protect electronic personal health data. It requires safeguards—administrative, physical, and technical—to ensure confidentiality, integrity, and security of health data.
ISO/IEC 27002:2022
ISO/IEC 27002 offers guidance on information security controls and serves as a practical implementation guide for ISO/IEC 27001, helping organizations select and apply controls to protect information assets.
NIS2 Directive
The NIS2 Directive sets EU-wide rules to strengthen cybersecurity for critical and important entities. It establishes stricter obligations for risk management, incident reporting, and governance, as defined in Directive (EU) 2022/2555 and Implementing Regulation (EU) 2024/2690.
DORA
Regulation (EU) 2022/2554 (DORA) establishes a harmonised framework to enhance the digital operational resilience of financial entities and their ICT service providers, ensuring they can withstand, respond to, and recover from ICT-related disruptions and cyber incidents.
PCI DSS v4.0.1
PCI DSS v4.0.1 is a global standard for protecting credit card data. It helps organizations prevent fraud by requiring access controls, encryption, and compliance, ensuring secure cardholder data handling practices.
ISO/IEC 31000:2018
ISO 31000 provides guidelines for risk management, helping organizations identify, assess, and treat risks. It integrates risk thinking into processes, improving resilience, efficiency, and informed decision-making.
ISO/IEC 27017:2015 (CSC)
ISO/IEC 27017:2015 provides cloud security guidance for Cloud Service Customers. It complements ISO 27002 by detailing controls for access, data protection, and shared responsibilities in cloud environments.
ENS
The National Security Framework (ENS), established by Royal Decree 311/2022, defines cybersecurity measures for public entities and providers. This self-assessment follows the ENS and the CCN-STIC 808 Guide by Spain’s National Cryptologic Center.
CIS CSC V8.1
The CIS Controls are prioritized best practices to secure IT systems. Version 8.1 improves clarity and helps organizations assess and enhance their cybersecurity posture through structured guidance and risk management.
ISO/IEC 22301:2019
ISO 22301 is the standard for Business Continuity Management. It helps organizations prepare for and recover from disruptions, ensuring critical business operations continue during emergencies and reducing downtime.
ISO/IEC 27017:2015 (CSP)
ISO/IEC 27017:2015 offers security guidance for Cloud Service Providers. As an extension of ISO 27002, it defines controls for secure service delivery, including virtualization, monitoring, and customer data handling.
NIST SP 800-171 Rev. 3
NIST SP 800-171 Rev. 3, issued in May 2024, defines security requirements to protect Controlled Unclassified Information (CUI) in nonfederal systems. This framework guides contractors and partners working with U.S. federal agencies.
EU AI ACT
The EU AI Act is a regulatory framework that classifies AI systems by risk level and sets rules to ensure safety, transparency, human oversight, and fundamental rights protection, aiming to foster trustworthy and lawful AI across the EU.
NIST AI RMF 600-1
The NIST AI Risk Management Framework helps assess and manage AI risks. It ensures AI systems are secure, ethical, transparent, and privacy-respecting while minimizing harm and supporting responsible innovation.
ISO/IEC 42001:2023
ISO 42001 is an international standard for managing AI responsibly. It helps organizations create an AI Management System (AIMS), address risks, and comply with legal, ethical, and social expectations effectively.
GDPR
The GDPR regulates how personal data is handled in the EU. It empowers individuals with control over their data and imposes strict responsibilities and penalties on organizations to ensure data protection.
Enveedo PIA
Enveedo PIA identifies privacy risks in data processing. It ensures safeguards are in place, aligns with laws like GDPR, and helps organizations mitigate risks before launching new data-handling activities.
Colombia Data Protection Law
Colombia’s Law 1581 sets privacy principles and rules for data protection. It ensures transparency, data security, and compliance obligations for entities that process personal data within the country.
Mexico Data Protection Law (Public)
This law applies to public entities in Mexico. It protects personal data through principles like transparency and accountability, ensuring individuals can control and access their data held by government.
Anexo 28 RMF 2024
Annex 28 of the 2024 RMF sets the technical and operational rules for submitting, storing, and validating electronic accounting before the Mexican tax authority. It defines formats, structure requirements, and digital compliance standards.
NIST Privacy Framework v1.0
The NIST Privacy Framework helps manage privacy risks when building systems and services. It supports compliance and enables responsible data-handling practices by identifying and reducing privacy risks.
Argentina Data Protection Law
Argentina’s Law 25,326 protects personal data and ensures individual privacy rights. It applies to both sectors and mandates that organizations process personal data under transparency and legal principles.
Mexico Data Protection Law (Private)
Mexico’s LFPDPPP regulates how private entities process personal data. It protects privacy rights and sets rules for lawful processing, ensuring transparency, consent, and appropriate data safeguards.
Chile Cybersecurity Law
Chile’s Cybersecurity Framework Law (21.663) requires public and private infrastructure to implement security measures, report incidents, and coordinate with national authorities to ensure cyber resilience.
Circular CO SA 17.18/24
Circular CO SA 17.18/24 provides supervision and control guidelines for financial entities, strengthening transparency duties, risk management practices, and regulatory reporting through enhanced governance and compliance standards
ISO/IEC 27701:2025
ISO/IEC 27701:2025 is an international standard that defines controls and guidance to establish and maintain a Privacy Information Management System (PIMS), supporting personal data management and compliance with data protection regulations.
Chile Data Protection Law (21.719)
Chile’s new Data Protection Law (21.719) mandates transparency and consent for data use, enforces rights like access, correction, and deletion, and aligns the country with global data standards by December 2026.
Peru Data Protection Law
Peru’s Law 29733 protects personal data by requiring consent, data security, and transparency. It ensures that individuals' privacy rights are respected in all public and private data processing activities.
Chile Data Protection Law (No. 19628)
Chile’s Law 19.628 regulates personal data protection. Although the new Law 21.719 has been published, Law 19.628 remains in force until December 2026, continuing to govern how personal data is collected, processed, and used.
LGPD
The LGPD is Brazil’s comprehensive data law, regulating the collection and use of personal data. It applies to all organizations processing data in Brazil and guarantees rights, informed consent, and strong data protection.
CE 007/2018 Requirements
This circular defines minimum cybersecurity requirements for financial entities in Colombia. It ensures information is protected through mandatory controls and enhances the financial sector’s cyber resilience.
Panama Data Protection Law
Panama’s Law 81 of 2019 regulates the protection of personal data, establishing principles like consent, purpose limitation, and data security. It applies to public and private entities that process personal data within Panama.
Costa Rica Data Protection Law
Costa Rica’s Law 8968 protects personal data through principles of consent, transparency, and proportionality. It ensures individuals' rights over their data and regulates public and private sector data processing activities.