Home›Frameworks›Information Security & Privacy

Information Security & Privacy

19 standards, regulations and schemes in this family. An information security or privacy requirement. Each page explains what it is, who has to follow it, what to write down, and who checks it.

Share
Ad from the publisher
Policy  Acknowledgment  Proof
AcknowledgedSecurity policy v4by name, on record
The Proof is Yourswith AllyMatter
Lock It the Modern WayEvery security and privacy policy on this page, acknowledged
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every name on record
Who read which version, and when
03
Walk in with the trail
From $29/mo, 20 editors, unlimited staff (published)

What is in this family

An information security or privacy requirement. The assessor reads policies first, then asks for the records that show they are followed. Typically assessed by: licensed CPA firm; Government enforcement only; PCI SSC qualified Qualified Security Assessor. Most asked about here: 3-DS, CCPA/CPRA, CMMC/NIST 800-171.

3-DSA PCI SSC qualified 3DS Assessor company with qualified 3DS assessor employees, performing the assessment per…CCPA/CPRANo certification. Enforcement is by CalPrivacy and the Attorney General through investigations and…CMMC/NIST 800-171Level 1 and Level 2 (self): the organization's own assessment with senior official affirmation. Level 2…FTC Safeguards/GLBAGovernment enforcement only. The FTC investigates and brings enforcement actions; there is no certification…GDPRNo mandatory assessor. Supervisory authorities (for example CNIL, the Irish DPC, the German state…HIPAAGovernment enforcement only. OCR investigates complaints and breach reports, conducts compliance reviews and…HITRUSTA HITRUST Authorized External Assessor organization (approved and trained by HITRUST) performs validated…ISO 27001An accredited certification body (registrar) operating under ISO/IEC 17021-1 and ISO/IEC 27006-1:2024, with…ISO 27017An accredited ISO/IEC 27001 certification body that includes ISO/IEC 27017 in the audit scope and issues a…ISO 27018An accredited ISO/IEC 27001 certification body that includes ISO/IEC 27018 in the audit scope and issues a…NIST CSFNone. NIST offers no certification and has no plans for a conformity assessment program, and there is no…NY DFS 23 NYCRR 500Government enforcement only. DFS examines covered entities and can impose penalties; there is no…PCI DSSA PCI SSC qualified Qualified Security Assessor (QSA) company with certified QSA employees performs the ROC.…PCI P2PEA PCI SSC qualified P2PE Assessor company (a QSA company additionally qualified for P2PE) with qualified P2PE…PCI PA-P2PEA PCI SSC qualified P2PE Application Assessor company, which is a P2PE Assessor company additionally…PCI SSFA PCI SSC qualified SSF Assessor company with employees qualified as Secure Software Assessors and/or Secure…QPAA PCI SSC qualified QPA company with qualified QPA employees, performing the on-site assessment per the QPA…SOC 2A licensed CPA firm (independent certified public accountants) performing the examination under the AICPA…TISAXAn ENX-approved TISAX audit provider (approval decided by the TISAX Committee) using auditors qualified for…

Get told when Information Security & Privacy standards change

One email when any of the Information Security & Privacy standards on this site changes. Nothing else.

No spam, and we never sell your address or give it to anyone. Double opt-in, and an unsubscribe link in every email. Subscribing accepts the Terms and Privacy Policy. Follow more than this →

Need a hand implementing it?

Find a Consultant for Information Security & Privacy: 19 Standards, and Who Helps

Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.

From the publisher

Keep Your Written Policies in One Place

Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.

See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff

About this data

Pages on this site are compiled by AllyMatter and checked against one or more sources, two or more where available. Each record shows its stage and date. Nothing here is legal, audit or tax advice, and policyandcompliance.com and AllyMatter, Inc. accept no responsibility for errors or for decisions made on it. Read the source, then decide.
How we compile and verify →

Think something is wrong?

[email protected]
Tell us the page and what you found. We check it against the source and fix it.

Want to advertise here?

[email protected]
Consultant listings, tool listings, press releases and the primary spot, flat fee, paid in advance. Prices and rules · Design examples · Press releases.