IronAudit
Framework library

Every framework, organized.

Browse 26 cybersecurity, privacy, industry, and AI governance frameworks. Filter by regulation type, pick a specific framework, or narrow to those with the metadata you need — then open any one for an interactive checklist.

Regulation type
Has content

Filters to frameworks where at least one control includes the selected metadata.

Showing 26 of 26 frameworks
Core Security
28 controls

NIST CSF 2.0

NIST (U.S.) · Global

Voluntary framework organizing cybersecurity risk management around six core functions.

Open framework
262228
Core Security
131 controls

NIST 800-53

NIST (U.S.) · United States

Catalog of security and privacy controls for federal information systems.

Open framework
15141948
Core Security
93 controls

ISO 27001

ISO/IEC · Global

International standard for information security management systems (ISMS).

Open framework
93939393
Core Security
18 controls

CIS v8

Center for Internet Security · Global

Prioritized set of 18 controls and 153 safeguards to defend against the most common cyber attacks.

Open framework
5618
Core Security
26 controls

SOC 2

AICPA · Global (U.S.-origin)

Auditing standard for service organizations covering security, availability, processing integrity, confidentiality, and privacy.

Open framework
632621
Core Security
22 controls

Cyber Essentials

UK National Cyber Security Centre (NCSC) · United Kingdom

UK government-backed scheme covering five technical control areas to defend against common cyber attacks.

Open framework
4527
Industry-Specific
12 controls

HIPAA

U.S. HHS / OCR · United States

U.S. federal regulation protecting electronic Protected Health Information (ePHI).

Open framework
239
Industry-Specific
12 controls

PCI DSS 4.0

PCI Security Standards Council · Global

Security standard for organizations that store, process, or transmit cardholder data.

Open framework
4511
Industry-Specific
23 controls

FedRAMP

U.S. GSA / FedRAMP PMO · United States

Standardized U.S. government approach to security assessment for cloud services.

Open framework
3428
Industry-Specific
16 controls

StateRAMP

StateRAMP (non-profit) · United States (state & local)

Standardized security framework for cloud services serving U.S. state and local governments.

Open framework
1113
Industry-Specific
42 controls

CMMC 2.0

U.S. Department of Defense · United States

Tiered cybersecurity certification for the Defense Industrial Base, built on NIST SP 800-171.

Open framework
139
Industry-Specific
37 controls

HITRUST

HITRUST Alliance · Global (U.S. healthcare focus)

Certifiable framework harmonizing HIPAA, ISO 27001, NIST, PCI DSS, and dozens of other authoritative sources.

Open framework
1113
Industry-Specific
12 controls

NERC CIP

NERC (North American Electric Reliability Corporation) · North America

Mandatory cybersecurity standards for the bulk electric system.

Open framework
2324
Industry-Specific
16 controls

GLBA

U.S. FTC · United States

Requires financial institutions to safeguard customer information.

Open framework
2117
Industry-Specific
19 controls

SOX ITGC

U.S. SEC / PCAOB · United States

IT General Controls supporting Sarbanes-Oxley Section 404 internal control over financial reporting.

Open framework
3313
Industry-Specific
29 controls

TISAX

ENX Association / VDA · Europe (automotive)

Trusted Information Security Assessment Exchange — automotive industry information security assessment.

Open framework
16
Industry-Specific
41 controls

BSI C5

Bundesamt für Sicherheit in der Informationstechnik (BSI) · Germany / EU

German federal cloud security catalogue setting baseline criteria for cloud service providers.

Open framework
16
Privacy & Regional
14 controls

GDPR

European Union · EU / EEA

Comprehensive EU privacy regulation governing personal data processing.

Open framework
234
Privacy & Regional
14 controls

CCPA / CPRA

California Privacy Protection Agency (CPPA) · California, USA

California's consumer privacy law granting access, deletion, correction, and opt-out rights.

Open framework
65106
Privacy & Regional
14 controls

PIPEDA

Office of the Privacy Commissioner of Canada · Canada

Canada's federal private-sector privacy law based on 10 fair information principles.

Open framework
6295
Privacy & Regional
13 controls

LGPD

ANPD (Autoridade Nacional de Proteção de Dados) · Brazil

Brazil's general data protection law, closely modeled on the GDPR.

Open framework
42610
Privacy & Regional
15 controls

ISO 27017/27018

ISO/IEC · Global

Cloud-specific extensions to ISO/IEC 27002 covering cloud security (27017) and PII in public clouds (27018).

Open framework
6487
Emerging & AI
14 controls

EU AI Act

European Union · EU

Risk-based regulation for AI systems placed on the EU market.

Open framework
72135
Emerging & AI
23 controls

NIST AI RMF

NIST (U.S.) · Global

Voluntary framework to manage risks from AI systems organized around four functions.

Open framework
63106
Emerging & AI
24 controls

ISO 42001

ISO/IEC · Global

International standard for AI management systems (AIMS).

Open framework
5178
Emerging & AI
22 controls

DORA

European Union (ESAs) · EU

EU regulation on ICT operational resilience for the financial sector.

Open framework
85119

Interactive checklist for every framework

Open any framework above to mark each control as Not started, In progress, Implemented, or N/A. Progress, notes, evidence links, and your full status-change history are saved locally in your browser — no account required.

Try the SOC 2 checklist