Framework library

GDPR is law, not a control framework: an obligation cannot be marked 'not applicable' because it is inconvenient, only because the processing it governs does not occur (for example Article 8 if no service is offered to children, or Article 27 if the organisation is established in the EU). Requirement text is paraphrased for assessment purposes — the articles themselves are authoritative, and this tool is not legal advice. UK GDPR (the retained version, as amended by the Data (Use and Access) Act 2025) follows the same article numbering; the supervisory authority is the ICO.

Many other US states now have comprehensive privacy laws modelled on similar ideas (opt-outs of sale and targeted advertising, sensitive-data consent, universal opt-out signals); a CCPA-ready programme covers much, but not all, of them. Dates and thresholds are as published by the CPPA; the monetary threshold is CPI-adjusted every odd-numbered year. Requirement text is paraphrased; the statute and regulations are authoritative and this tool is not legal advice.

SOC 2 is an attestation against criteria, not a certification against a fixed control list. Auditors expect the organisation to describe its own controls and then demonstrate they operate. Requirement text below is paraphrased; cite the AICPA source for audit work.

Certification is against the clause 4–10 management system, with Annex A used to justify inclusions and exclusions in the Statement of Applicability. A control marked 'not applicable' with a documented rationale is a valid outcome, which this tool records as an explicit exclusion rather than a gap. Requirement text is paraphrased; the standard itself is copyright ISO.

PCI DSS is a contractual standard enforced through acquirers and card brands, not a law. What applies depends on how you accept cards and your validation level (SAQ type or ROC): a merchant that fully outsources payment pages may be in scope for only a handful of these requirements — mark the rest not applicable with that reason. Requirement text is paraphrased; the standard itself, available free from the PCI SSC, is authoritative.

Each standard is marked Required (R) or Addressable (A). Addressable does not mean optional: the entity must implement the specification, or document why it is not reasonable and appropriate and implement an equivalent alternative. This tool records that documented-alternative path explicitly, because treating 'addressable' as 'skip' is the single most common HIPAA finding.

Institutions that maintain customer information about fewer than 5,000 consumers are exempt from 314.4(b)(1) (written risk assessment), (d)(2) (penetration testing and vulnerability assessments), (h) (written incident response plan) and (i) (annual board report) under 16 CFR 314.6 — mark those not applicable with that reason. Banks follow the equivalent Interagency Guidelines rather than the FTC rule. Requirement text is paraphrased; the regulation is authoritative and this tool is not legal advice.

If the service is not directed to children and has no actual knowledge of collecting from under-13s, most of these controls are not applicable — record that assessment under 312.2-312.3. FTC-approved safe harbor programmes (312.11) offer an alternative route to demonstrate compliance. Requirement text is paraphrased; the regulation is authoritative and this tool is not legal advice.

CSF is a voluntary framework organised around outcomes, not a prescriptive control list, and is intended to be tailored to an organisation's risk profile. Subcategory text is paraphrased.

Section references are to the Act as assented (Act No. 37 of 2023). Where a duty comes from the NDPC's General Application and Implementation Directive (GAID) 2025 rather than the Act itself, the control ID says so. Requirement text is paraphrased for assessment purposes and is not legal advice; the NDPC continues to issue subsidiary guidance that refines several of these duties.