https://security-recipes.ai/recipes/general/compliance-standards/Recent content in Compliance standards on security-recipes.aien-ushttps://security-recipes.ai/recipes/general/compliance-standards/cis-controls-safeguard-implementation-check/https://security-recipes.ai/recipes/general/compliance-standards/cis-controls-safeguard-implementation-check/Sun, 12 Jul 2026 00:00:00 GMTOrganizations using the CIS Controls and Implementation Groups to prioritize a defensible baseline security program.https://security-recipes.ai/recipes/general/compliance-standards/iso27001-secure-development-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/iso27001-secure-development-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTOrganizations operating or preparing to certify an information security management system against ISO/IEC 27001:2022.https://security-recipes.ai/recipes/general/compliance-standards/nist-ssdf-repo-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/nist-ssdf-repo-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTSoftware producers assessing secure development practices and repository evidence against NIST SP 800-218.https://security-recipes.ai/recipes/general/compliance-standards/pci-dss-cde-agent-boundary-check/https://security-recipes.ai/recipes/general/compliance-standards/pci-dss-cde-agent-boundary-check/Sun, 12 Jul 2026 00:00:00 GMTEntities that store, process, or transmit payment account data, and service providers that can affect the cardholder data environment.https://security-recipes.ai/recipes/general/compliance-standards/slsa-provenance-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/slsa-provenance-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTSoftware producers and consumers evaluating source and build integrity using SLSA v1.2 tracks and provenance.https://security-recipes.ai/recipes/general/compliance-standards/soc2-change-management-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/soc2-change-management-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTService organizations preparing evidence for a SOC 2 examination using the applicable Trust Services Criteria.https://security-recipes.ai/recipes/general/compliance-standards/ai-governance-oversight-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/ai-governance-oversight-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTOrganizations extending secure software development practices to AI model development across the AI lifecycle.https://security-recipes.ai/recipes/general/compliance-standards/nist-csf-2-0-profile-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/nist-csf-2-0-profile-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTOrganizations using CSF 2.0 Organizational Profiles and Tiers to communicate and improve cybersecurity risk outcomes.https://security-recipes.ai/recipes/general/compliance-standards/nist-sp-800-53-rev5-control-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/nist-sp-800-53-rev5-control-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTInformation systems using an organization-selected NIST SP 800-53 Rev. 5 control baseline or overlay.https://security-recipes.ai/recipes/general/compliance-standards/nist-sp-800-171-rev3-cui-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/nist-sp-800-171-rev3-cui-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTNonfederal organizations protecting Controlled Unclassified Information in systems subject to federal contract or policy requirements.https://security-recipes.ai/recipes/general/compliance-standards/hipaa-security-rule-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/hipaa-security-rule-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTHIPAA covered entities and business associates protecting electronic protected health information; the January 2025 modification remains proposed, not final.https://security-recipes.ai/recipes/general/compliance-standards/eu-gdpr-accountability-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/eu-gdpr-accountability-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTControllers and processors handling personal data within GDPR territorial scope, including applicable extraterritorial processing.https://security-recipes.ai/recipes/general/compliance-standards/csa-ccm-4-1-cloud-control-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/csa-ccm-4-1-cloud-control-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTCloud service providers and cloud customers assessing cloud control responsibilities using CSA CCM v4.1.https://security-recipes.ai/recipes/general/compliance-standards/cobit-2019-governance-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/cobit-2019-governance-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTEnterprises designing, evaluating, or improving governance of information and technology using COBIT 2019.https://security-recipes.ai/recipes/general/compliance-standards/sox-itgc-financial-reporting-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/sox-itgc-financial-reporting-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTPublic-company financial reporting environments where IT general controls support internal control over financial reporting; AS 2201 amendments become effective December 15, 2026.https://security-recipes.ai/recipes/general/compliance-standards/glba-safeguards-rule-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/glba-safeguards-rule-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTFTC-regulated financial institutions maintaining a written information security program for customer information.https://security-recipes.ai/recipes/general/compliance-standards/nydfs-part-500-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/nydfs-part-500-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTNYDFS covered entities, with obligations determined by covered-entity and class-A status and the amendment's phased effective dates.https://security-recipes.ai/recipes/general/compliance-standards/sec-cybersecurity-disclosure-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/sec-cybersecurity-disclosure-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTSEC reporting companies preparing evidence for material cybersecurity incident and annual risk-management, strategy, and governance disclosures.https://security-recipes.ai/recipes/general/compliance-standards/owasp-asvs-5-0-0-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/owasp-asvs-5-0-0-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTTeams specifying or verifying web application security requirements against an explicitly selected ASVS level and version.https://security-recipes.ai/recipes/general/compliance-standards/owasp-api-security-top-10-2023-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/owasp-api-security-top-10-2023-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTAPI owners using the 2023 risk categories to drive threat review, testing, and remediation; it is not a certification standard.https://security-recipes.ai/recipes/general/compliance-standards/owasp-masvs-2-1-0-mobile-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/owasp-masvs-2-1-0-mobile-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTNative and cross-platform mobile application teams verifying security and privacy properties against MASVS 2.1.0.https://security-recipes.ai/recipes/general/compliance-standards/owasp-samm-2-1-program-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/owasp-samm-2-1-program-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTOrganizations measuring and improving a software security program using the OWASP SAMM maturity model.https://security-recipes.ai/recipes/general/compliance-standards/openssf-osps-baseline-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/openssf-osps-baseline-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTOpen source projects and downstream consumers evaluating baseline security practices at an explicitly selected OSPS level.https://security-recipes.ai/recipes/general/compliance-standards/eu-cyber-resilience-act-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/eu-cyber-resilience-act-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTManufacturers, importers, and distributors of products with digital elements placed on the EU market, subject to role, product, and exception analysis.https://security-recipes.ai/recipes/general/compliance-standards/nist-iot-8259-rev1-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/nist-iot-8259-rev1-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTIoT product manufacturers and integrators establishing product cybersecurity capabilities and manufacturer supporting activities.https://security-recipes.ai/recipes/general/compliance-standards/fda-medical-device-cybersecurity-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/fda-medical-device-cybersecurity-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTMedical device manufacturers preparing premarket cybersecurity documentation; the February 2026 final guidance supersedes the June 2025 version.https://security-recipes.ai/recipes/general/compliance-standards/iec-62443-industrial-security-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/iec-62443-industrial-security-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTAsset owners and product suppliers evaluating industrial automation and control system security programs against organization-licensed IEC 62443 parts.https://security-recipes.ai/recipes/general/compliance-standards/nerc-cip-applicable-standards-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/nerc-cip-applicable-standards-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTRegistered entities with Bulk Electric System Cyber Systems; applicability and effective versions must be established from the current NERC standards and implementation plans.https://security-recipes.ai/recipes/general/compliance-standards/nist-ai-rmf-1-0-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/nist-ai-rmf-1-0-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTOrganizations governing, mapping, measuring, and managing AI risks using AI RMF 1.0 while NIST develops a revision.https://security-recipes.ai/recipes/general/compliance-standards/iso42001-ai-management-system-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/iso42001-ai-management-system-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTOrganizations establishing, operating, or preparing to certify an AI management system against ISO/IEC 42001:2023.https://security-recipes.ai/recipes/general/compliance-standards/eu-ai-act-evidence-readiness-check/https://security-recipes.ai/recipes/general/compliance-standards/eu-ai-act-evidence-readiness-check/Sun, 12 Jul 2026 00:00:00 GMTAI providers, deployers, importers, distributors, and product manufacturers after role, system classification, exclusions, and current phased dates are verified with official Commission guidance.https://security-recipes.ai/recipes/general/compliance-standards/fedramp-2026-rev5-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/fedramp-2026-rev5-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTCloud service offerings pursuing or maintaining a FedRAMP authorization under the 2026 consolidated rules and Rev. 5 control baseline.https://security-recipes.ai/recipes/general/compliance-standards/cmmc-2-0-evidence-readiness-check/https://security-recipes.ai/recipes/general/compliance-standards/cmmc-2-0-evidence-readiness-check/Sun, 12 Jul 2026 00:00:00 GMTDefense contractors and subcontractors whose solicitations or contracts specify a CMMC level and assessment requirement for FCI or CUI.https://security-recipes.ai/recipes/general/compliance-standards/cjis-security-policy-6-1-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/cjis-security-policy-6-1-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTCriminal justice agencies, noncriminal justice agencies, and service providers handling Criminal Justice Information under applicable agreements.https://security-recipes.ai/recipes/general/compliance-standards/cisa-cross-sector-cpg-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/cisa-cross-sector-cpg-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTCritical infrastructure owners and operators prioritizing a voluntary baseline of high-impact cybersecurity practices while CISA updates the CPGs for CSF 2.0.https://security-recipes.ai/recipes/general/compliance-standards/eu-dora-evidence-readiness-check/https://security-recipes.ai/recipes/general/compliance-standards/eu-dora-evidence-readiness-check/Sun, 12 Jul 2026 00:00:00 GMTEU financial entities and relevant ICT third-party service relationships after entity, proportionality, and exemption analysis.https://security-recipes.ai/recipes/general/compliance-standards/eu-nis2-evidence-readiness-check/https://security-recipes.ai/recipes/general/compliance-standards/eu-nis2-evidence-readiness-check/Sun, 12 Jul 2026 00:00:00 GMTEntities potentially classified as essential or important under NIS2 and the applicable member-state implementing law.https://security-recipes.ai/recipes/general/compliance-standards/nist-privacy-framework-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/nist-privacy-framework-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTOrganizations using Privacy Framework 1.0 to manage privacy risk; version 1.1 remains an Initial Public Draft and must not be treated as final.https://security-recipes.ai/recipes/general/compliance-standards/iso27701-2025-privacy-management-evidence-check/https://security-recipes.ai/recipes/general/compliance-standards/iso27701-2025-privacy-management-evidence-check/Sun, 12 Jul 2026 00:00:00 GMTOrganizations establishing, operating, or preparing to certify a privacy information management system against ISO/IEC 27701:2025.