The Center for Internet Security's prioritised set of 18 controls and 153 safeguards for cyber defence. Implementation Groups IG1, IG2 and IG3 stage adoption from a hygiene baseline up to advanced defence.
Compliance guides & controls library
Implementation guides for SOC 2, ISO 27001, HIPAA, GDPR, India's DPDP Act, NIST SP 800-53 and NIST SP 800-171, plus one article per control across 12 frameworks.
Compliance implementation guides
Practical, step-by-step guides: who each framework applies to, how to scope it, a phased roadmap, the hardest controls on AWS, Azure and GCP, and how the audit or assessment runs.
SOC 2SOC 2 compliance: a practical implementation guide for cloud-native SaaS teamsRead the guide →ISO 27001ISO/IEC 27001:2022 compliance: a practical implementation guideRead the guide →HIPAAHIPAA compliance for SaaS: a practical implementation guideRead the guide →GDPRGDPR compliance: a practical implementation guide for cloud-native SaaS teamsRead the guide →DPDP ActIndia's DPDP Act 2023: a practical compliance guide for cloud teamsRead the guide →NIST SP 800-53NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teamsRead the guide →NIST SP 800-171NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloudRead the guide →
Control libraries
All 93 Annex A controls of ISO/IEC 27001:2022 — the international standard for an Information Security Management System. The 2022 revision consolidated the 114 controls of the 2013 edition into 93 across four themes (organizational, people, physical, technological) and tagged each with new attributes (preventive / detective / corrective; confidentiality / integrity / availability).
The first international AI Management System (AIMS) standard. 38 Annex A controls covering AI policy, AI lifecycle, data for AI, information for interested parties, and use of AI systems by or from third parties. Pairs directly with EU AI Act compliance and is increasingly required in enterprise AI vendor risk reviews.
The AICPA's Trust Services Criteria — the security, availability, processing integrity, confidentiality and privacy criteria a SOC 2 auditor tests against. The Common Criteria (CC1–CC9) are mandatory; the category-specific criteria (A, C, PI, P) are in-scope based on the engagement's selected categories.
All 195 administrative, physical, technical, organisational and documentation safeguards from 45 CFR Parts 160 and 164, as amended by the 2013 Omnibus Final Rule. Applies to Covered Entities and their Business Associates handling Protected Health Information (PHI).
All 99 articles of the EU General Data Protection Regulation — the world's most-cited modern privacy law. Applies to any organisation offering goods or services to, or monitoring, individuals in the EU/EEA, regardless of where the organisation is established.
Every control and control enhancement from NIST Special Publication 800-53 Revision 5 — the U.S. federal catalogue for security and privacy. Organised by 20 control families (AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, SR). FedRAMP, FISMA, CMMC and many state regulations point directly at SP 800-53 baselines.
The 100 security requirements for protecting Controlled Unclassified Information (CUI) in non-federal systems — the technical baseline that CMMC Level 2 inherits and that every DoD prime and subcontractor must implement to keep CUI contracts.
The German Federal Office for Information Security's 2020 Cloud Computing Compliance Criteria Catalogue — the baseline German public-sector buyers and many DAX-listed enterprises expect from their cloud providers. Each criterion has Basic and Additional objectives; attestation is performed under ISAE 3000 / IDW PS 860 as a Type 1 or Type 2 report.
India's Digital Personal Data Protection Act 2023 obligations, translated from statute into 36 implementable controls for Data Fiduciaries operating in or processing the data of Data Principals in India. Enforced by the Data Protection Board of India once notified by the Central Government.
The Privacy Information Management System extension to ISO/IEC 27001 — controls for PII controllers and processors that evidence GDPR-style accountability and form the most-recognised international way to demonstrate alignment with major privacy regulations.
One page per icompaas-tracked policy document (Information Security Policy, Acceptable Use Policy, Access Control Policy, ...). Each article describes the policy itself — purpose, typical structure, why every organization needs one, the icompaas lifecycle — and links to every compliance control across all 11 frameworks that references it.