The right framework for a client depends on where they operate, their industry, their size and their goals. Use the tables in this article to narrow down which frameworks are worth a look, then add them from the framework catalog in ControlMap. For steps, see Add and switch frameworks.
What is a framework?
A framework gives structure to a compliance program. It sets out the requirements, such as controls, documents, evidence and practices, that an organization needs to meet for a specific law, regulation or security standard. ControlMap includes more than 75 frameworks, and you can also build your own with Custom Frameworks.
How to choose
Start with what a client is required to meet, then add what they want to show customers. For example:
- A client that handles personal data of people in the EU needs GDPR. If the people are in the UK, use UK GDPR-DPA.
- A U.S. client that handles patient health information needs HIPAA.
- A client that subcontracts for the U.S. Department of Defense needs CMMC.
- A client with no specific requirement often starts with CIS Controls or NIST CSF, which give a solid baseline that maps to many other frameworks.
When a framework comes in several versions, choose the newest one for new programs unless a client's auditor, compliance advisor or contract names a specific version. Search the framework catalog by name to see which versions are available.
Note: These tables are a starting point, not legal or compliance advice. For guidance on a specific client, talk to a compliance advisor.
Most popular
These frameworks are the ones MSPs pick most often. Find the details for each in its region table below.
| Framework | Common fit |
|---|---|
| CIS Controls | Organizations of any size that want a practical, prioritized starting point. |
| CMMC | U.S. Department of Defense contractors and subcontractors. |
| FTC Safeguards | U.S. non-bank financial institutions. |
| GDPR / UK GDPR-DPA | Anyone handling personal data of people in the EU or UK. |
| HIPAA | U.S. healthcare organizations and their business associates. |
| ISO 27001 | Organizations that want an internationally recognized security certification. |
| NIST CSF | Organizations of any size that want a flexible, risk-based program. |
| PCI DSS | Anyone that stores, processes or transmits payment card data. |
| SOC 2 | Service providers, SaaS and cloud companies whose customers ask for an audit report. |
Global
| Framework | Industries | Purpose |
|---|---|---|
| CIS Controls | Government, energy, healthcare, finance and education. | Provide prioritized, prescriptive safeguards that organizations can put in place quickly. Defend against the most common attacks, such as phishing, ransomware and credential theft. |
| ISO 27001 | Technology, finance, manufacturing and global enterprises. | Set up an information security management system (ISMS) that protects the confidentiality, integrity and availability of data, using a risk-based approach. |
| ISO 27701 | Organizations that process personal data, often alongside ISO 27001. | Extend an ISO 27001 ISMS to manage privacy and personally identifiable information (PII). |
| ISO/IEC 27017 | Cloud service providers and cloud customers. | Add cloud-specific security controls on top of ISO 27001. |
| ISO/IEC 27018 | Public cloud providers that process PII for customers. | Protect PII held in public cloud services. |
| ISO/IEC 42001 | Organizations that build, provide or use AI systems. | Set up a management system for developing and using AI responsibly. |
| ISO 9001 | Manufacturing, services and any organization seeking quality certification. | Set up a quality management system. This is a quality standard rather than a security standard. |
| PCI DSS | Retail, e-commerce, banking, healthcare, utilities and hospitality. | Protect cardholder data and sensitive authentication data. |
| SOC 2 | SaaS, cloud, fintech, healthcare, energy, utilities and e-commerce. | Give customers independent assurance that a service provider manages their data securely. A SOC 2 report can be reused instead of answering many separate vendor reviews. |
| CSA Cloud Controls Matrix (CSA-CCM) | Cloud service providers and cloud customers. | Apply the Cloud Security Alliance control set for securing cloud services. |
| COBIT | Enterprises, finance and organizations with formal IT audit needs. | Govern and manage enterprise IT so it supports business goals and manages risk. |
| Secure Controls Framework (SCF) | Organizations that need to meet several frameworks at once. | Use one large set of controls that maps to many laws, regulations and standards. |
| TISAX | Automotive manufacturers and their suppliers. | Show automotive partners that information security meets the industry's shared assessment standard. |
| Motion Picture Association (MPA) | Film and TV vendors, such as post-production and VFX facilities. | Meet the MPA's content security best practices for protecting studio content. |
| Microsoft DPR | Suppliers that process personal or confidential data for Microsoft. | Meet Microsoft's Supplier Data Protection Requirements. |
| GTIA Cybersecurity Trustmark | MSPs and technology solution providers. | Show clients that your own cybersecurity practices meet an industry-recognized standard. |
| SMB1001 | Small and medium-sized businesses. Developed in Australia and used internationally. | Offer a tiered certification path so smaller businesses can build their security step by step. |
United States
| Framework | Industries | Purpose |
|---|---|---|
| NIST CSF | Organizations of all sizes, critical infrastructure and government contractors. Widely used outside the U.S. | Provide a common, risk-based language for managing cybersecurity. |
| CMMC | U.S. Department of Defense contractors and subcontractors. | Show the DoD that you protect Federal Contract Information (Level 1) and Controlled Unclassified Information (Level 2). |
| NIST 800-171 | Defense industrial base, manufacturing, energy, healthcare, technology and cloud providers. | Protect Controlled Unclassified Information (CUI) outside federal systems. CMMC Level 2 is built on NIST 800-171. |
| NIST 800-53 | Federal agencies, federal contractors and cloud providers. | Apply the federal catalog of security and privacy controls. |
| NIST SP 800-161 | Federal agencies and their suppliers. | Manage cybersecurity risk across the supply chain. |
| NIST Privacy Framework | Any organization handling personal data. | Identify and manage privacy risk alongside cybersecurity risk. |
| NIST AI Risk Management Framework | Healthcare, finance, energy, retail, government and technology. | Manage AI risk across the lifecycle. |
| FedRAMP | Cloud service providers selling to U.S. federal agencies. | Meet the security requirements for federal cloud authorization. Pick the baseline (Low, Moderate or High) that matches the impact level of the data. |
| TX-RAMP | Cloud and SaaS providers selling to Texas state agencies. | Meet the Texas baseline for cloud services used by state agencies. |
| CJIS | Law enforcement, courts, government IT providers and their vendors. | Protect criminal justice information under the FBI CJIS Security Policy. |
| HIPAA | Hospitals, clinics, doctors, pharmacies, health insurers, health plans and their business associates. | Protect health information under the Health Insurance Portability and Accountability Act of 1996, as set out by HHS. Covers the Security, Privacy and Breach Notification Rules. |
| Minimum Acceptable Risk Standards (MARS-E) | Health insurance exchanges under the Affordable Care Act and their contractors. | Meet the CMS Minimum Acceptable Risk Standards for Exchanges. |
| FTC Safeguards | Non-bank financial institutions, such as lenders, tax preparers and auto dealers. | Protect customers' nonpublic personal information under the FTC Safeguards Rule. |
| NYDFS (23 NYCRR 500) | Banks, insurers, fintech, crypto and investment firms regulated in New York. | Meet the New York State Department of Financial Services cybersecurity regulation. |
| FFIEC Cybersecurity Assessment | Banks and credit unions. | Compare inherent risk with cybersecurity maturity, using the structure examiners expect. |
| CRI Profile | Banks, insurers and other financial services firms. | Use a financial-sector profile built on NIST CSF that maps to many financial regulations. |
| FINRA Checklist | Broker-dealers and securities firms. See SEC and FINRA Registered Firms: Which framework to use? | Give small and medium firms a structured starting point for a cybersecurity program. |
| SOC 1 | Payroll providers, claims processors and financial SaaS vendors. | Give customers and their financial auditors assurance over controls that affect financial reporting. |
| CCPA (California Consumer Privacy Act) | Technology, retail, finance, healthcare, utilities and energy. | Give California residents control over their personal information. |
| Maritime Security | Maritime and port facilities, vessels and transportation. | Meet U.S. Coast Guard maritime security requirements (33 CFR) to prevent, detect and respond to security and cybersecurity incidents. |
Canada
| Framework | Industries | Purpose |
|---|---|---|
| Canada Cybersecurity Small Business | Professional services, healthcare practices, retail and e-commerce. | Protect small and medium businesses against common threats such as phishing, ransomware and data theft. |
| Cybersecure Canada | Professional services, healthcare, retail, e-commerce, startups and SaaS providers. | Reach a baseline of cybersecurity with the national standard behind the government-backed CyberSecure Canada certification. |
United Kingdom
| Framework | Industries | Purpose |
|---|---|---|
| UK GDPR-DPA | Any organization handling personal data of people in the UK. | Meet the UK General Data Protection Regulation and the Data Protection Act 2018. |
| UK Cyber Essentials | Government suppliers, healthcare, education, SMEs, energy, finance and charities. | Protect against common attacks such as phishing, malware and password attacks, and show a verified security baseline. |
| IASME Cyber Assurance | SMEs and supply chain partners that need more than Cyber Essentials. | Assess security and governance more broadly than Cyber Essentials, with a level that can be independently audited. |
| IASME Cyber Baseline | IT services, finance and insurance, healthcare and government contractors, including outside the UK. | Give smaller organizations a practical way to assess and improve their security without a complex certification. |
| Privacy Accountability Framework (UK ICO) | Healthcare, finance, energy, retail, government and education. | Build data protection into governance and be able to show compliance, not just claim it. |
European Union
| Framework | Industries | Purpose |
|---|---|---|
| DORA | Banks, insurers, investment firms and their ICT providers. | Create one EU-wide set of rules for managing ICT risk and operational resilience in finance. |
| GDPR | Any organization handling personal data of people in the EU. | Protect individuals' rights over their personal data and harmonize data protection law across the EU. |
| NIS2 Directive | Energy, transport, banking, health, digital infrastructure and other essential sectors. | Raise cybersecurity resilience across the EU and protect essential services and supply chains. |
Australia
| Framework | Industries | Purpose |
|---|---|---|
| Australia Energy (AESCSF) | Electricity, gas, oil and energy retail. | Provide a sector-specific framework to help energy companies identify, manage and reduce cyber risk. |
| Essential Eight | Energy and utilities, financial services, healthcare, education and research. | Reduce cyber risk with eight prioritized mitigation strategies. Includes a maturity model (levels 0 to 3) so organizations can improve over time. |
| Prudential Standard CPS 234 | Banking, insurance and superannuation (APRA-regulated entities). | Strengthen information security resilience across Australia's financial sector. |
| PSPF | Australian Government entities and their suppliers. | Protect the Australian Government's people, information and assets through the Protective Security Policy Framework. |
New Zealand
| Framework | Industries | Purpose |
|---|---|---|
| NZ Information Security Manual (NZISM) | Government agencies, defense, health, police, cloud providers and critical infrastructure. | Provide the baseline standard for securing New Zealand Government ICT systems and information. |
| Any questions? Reach out to our friendly, neighborhood support team by submitting a support ticket. |
| 🎙️ Interested in learning more about ControlMap? Join an MSP Power-Up, part of our free micro-workshop series for MSPs. View upcoming sessions and register: MSP Power-Ups: ControlMap. |
