Which security standards and laws apply to you?

The standards, frameworks and laws behind a security requirement

A security requirement reaches a company in three shapes. A customer's questionnaire or contract asks for a standard, usually ISO/IEC 27001. A framework such as NIST's gives a programme its structure and a control catalogue to assess against. And a law binds you not because a contract says so but because of what you are and what you sell: NIS2, DORA, the Cyber Resilience Act, GDPR. This page explains the three, how they fit, and where the documents come from. The explorer below then finds the ones that match your situation.

Start with ISO/IEC 27001

ISO/IEC 27001 is the international standard for an information security management system, and the one a customer asks about first. It is certifiable, it is the same in every industry, and its main text lists no technical measures: it asks you to run a management system that knows what information you hold, assesses the risks to it, chooses controls and keeps evidence that they work. The 2022 edition's Annex A holds 93 controls in four themes, organisational, people, physical and technological. ISO/IEC 27002 explains each control and how to implement it, and ISO/IEC 27005 describes the risk assessment the standard requires but does not spell out. See ISO/IEC 27001, ISO/IEC 27002 and ISO/IEC 27005.

Around that core sit the extensions a particular customer asks for. ISO/IEC 27017 adds controls for cloud services and ISO/IEC 27018 protects personal data in a public cloud; both are what a cloud provider is asked to show. ISO/IEC 27701 extends the management system to privacy, the shape a GDPR programme can be run in. ISO/IEC 27035 covers incident management, and ISO 22301 business continuity. None of them stands alone: each is read on top of a 27001 system. See ISO/IEC 27017 and ISO/IEC 27018.

Frameworks and control catalogues

A framework is not a certificate. It is a structure to organise a programme and a catalogue to assess it against, and it is what an auditor, an insurer or a US customer measures you with. The NIST Cybersecurity Framework 2.0, from 2024, has six functions, Govern, Identify, Protect, Detect, Respond and Recover, and maps to the catalogues underneath it. NIST SP 800-53 is the control catalogue US federal systems are assessed against and the one most other catalogues cross-reference. NIST SP 800-171 is the subset a supplier to the US Department of Defense meets to handle controlled unclassified information, and the basis of the CMMC certification programme. The CIS Controls are eighteen prioritised safeguard groups in three implementation groups by organisation size, and the usual first step when nothing formal exists yet.

Two frameworks are sector-specific. IEC 62443 is the security series for industrial automation and control systems: zones and conduits for the plant, a secure development life cycle for the product (part 4-1) and technical requirements for components (part 4-2). TISAX is the automotive industry's exchange of information security assessments against the VDA ISA catalogue, and what a supplier to a German car maker is asked for. And two are attestations rather than standards: a SOC 2 report is an auditor's opinion on a service organisation's controls against the AICPA Trust Services Criteria, the document a US customer asks a SaaS provider for; the EU Cybersecurity Act's certification schemes are the European counterpart, still being rolled out.

The EU laws

A standard binds you because a contract says so. A law binds you because of what you are. Five EU acts now carry security obligations directly, and each has its own scope.

NIS2, Directive (EU) 2022/2555, applies to essential and important entities in eighteen sectors, from energy and transport to digital infrastructure, manufacturing of critical products and public administration. It is transposed into national law, so the exact duties come from your own country's act, but the shape is the same everywhere: management accountability, risk-management measures on a fixed list, supply-chain security, and early warning of a significant incident within 24 hours. The CER Directive, 2022/2557, is its physical-resilience counterpart for critical entities.

DORA, Regulation (EU) 2022/2554, applies since January 2025 to financial entities and to their critical ICT third-party providers. It asks for ICT risk management, incident reporting, resilience testing including threat-led penetration testing for the largest, and a register of every ICT contract. It applies directly, with no national transposition.

The Cyber Resilience Act, Regulation (EU) 2024/2847, reaches products rather than organisations: hardware and software with digital elements placed on the EU market must be secure by design, handle vulnerabilities for their support period and carry the CE mark for it. Reporting of actively exploited vulnerabilities starts in September 2026 and the full obligations apply from December 2027. ETSI EN 303 645 is the baseline the consumer-IoT part of it draws on.

GDPR, Regulation (EU) 2016/679, is the oldest of the five and the one everybody already meets: security of processing appropriate to the risk, and breach notification to the supervisory authority within 72 hours. Two newer acts touch the edges: eIDAS 2, Regulation (EU) 2024/1183, for trust services and the European Digital Identity Wallet, and the AI Act, Regulation (EU) 2024/1689, whose high-risk systems need a risk management system and a quality management system of their own.

How a certificate and a law fit together

An ISO/IEC 27001 certificate does not by itself satisfy NIS2 or DORA; the laws have their own scope, their own reporting clocks and their own supervisors. But the measures they list, risk analysis, incident handling, business continuity, supply-chain security, access control, encryption, are the measures a 27001 system runs, and the national authorities and ENISA reference ISO/IEC 27001 and the NIST framework in their guidance. A certified management system is the usual way to show a supervisor that the measures exist and are run, and a risk register and an incident log are the evidence both a certification auditor and a regulator read.

Where the documents come from

ISO/IEC standards are bought from ISO, from IEC or from your national standards body. Every NIST publication is free from NIST's Computer Security Resource Center, and the CIS Controls are free with registration. The EU acts are free on EUR-Lex, and every regulation entry in the explorer links to the consolidated text there; the national transpositions of NIS2 and CER come from your own legislature. IEC 62443 is bought from IEC or ISA, SOC 2's criteria come from the AICPA, and TISAX from the ENX Association.

Who decides what applies to you

Not this page, and not us. A contract or a questionnaire names the standard; a law names its own scope, and whether you fall inside it is a question about your sector, your size and what you sell that your counsel answers. What the explorer can do is show you the whole map: search it by number or name, browse it by family, or answer five questions about your situation and see which areas companies like you are commonly asked about. Each entry links to its source, to its ComplyTrain page where one exists, and otherwise to a request. ComplyTrain holds a standard as a requirement tree with the evidence against each requirement. The certificate stays yours to earn.