Understand what governs you. See how it all connects.

ISO/IEC 27001 provides a structured management-system approach for protecting information and managing information-security risk. Rather than treating cybersecurity as a collection of isolated technical controls, it connects leadership, risk assessment, policies, responsibilities, controls, evidence and continual improvement. For organizations operating across complex digital environments, the standard provides a foundation for building a repeatable, measurable and auditable information-security program.

The NIST Cybersecurity Framework provides organizations with a flexible, outcome-oriented approach for understanding and managing cybersecurity risk. It establishes a common language through which cybersecurity teams, enterprise risk functions, executives and business leaders can discuss cyber exposure and priorities. Its value extends beyond technical security by connecting cybersecurity outcomes with organizational objectives, risk decisions and governance responsibilities.

NIST SP 800-53 provides an extensive catalog of security and privacy controls designed to protect information systems, organizations and individuals. It covers a broad range of governance, technical and operational control areas and is particularly valuable for organizations requiring a highly structured security-control environment. The publication supports detailed traceability between information systems, safeguards, assessments, risks and assurance activities.

The CIS Controls provide a prioritized set of cybersecurity safeguards intended to help organizations defend against common and significant cyber threats. Their practical and implementation-oriented structure makes them useful for organizations seeking a clear cybersecurity baseline. The Controls help translate broad security objectives into concrete operational practices that can be assigned, implemented, measured and improved.

ISA/IEC 62443 addresses cybersecurity across industrial automation and control-system environments. It is particularly relevant to energy, utilities, manufacturing, transportation and other critical-infrastructure sectors where operational technology is directly connected to physical processes. The series recognizes that OT environments have distinct availability, safety, lifecycle and security considerations compared with conventional enterprise IT.

PCI DSS establishes security requirements for organizations that store, process or transmit payment account data. Its objective is to reduce exposure of payment environments through defined safeguards covering networks, systems, identities, vulnerabilities, monitoring and access to sensitive payment information. Maintaining compliance therefore requires continuing operational discipline rather than a one-time certification exercise.

ISO 31000 provides principles, a framework and guidance for managing risk across an organization. Its purpose is not to create risk management as a separate administrative activity, but to integrate consideration of uncertainty into governance, strategy, planning, operations and decision-making. The approach can therefore be applied to strategic, operational, technology, cyber, financial, project and emerging risks.

COSO Enterprise Risk Management provides a framework for integrating risk with strategy and organizational performance. Rather than treating risk as a reporting exercise performed after important decisions have already been made, COSO ERM encourages organizations to consider uncertainty while establishing strategy, defining objectives, evaluating alternatives and reviewing performance.

COBIT provides a structured framework for governing and managing enterprise information and technology. It helps organizations establish governance and management objectives, decision responsibilities and performance mechanisms around technology. This becomes increasingly important as digital capabilities, cybersecurity, data and technology investment become inseparable from business strategy and operational delivery.

ISO 22301 establishes requirements for a structured Business Continuity Management System. It helps organizations understand disruptive risk, identify priority activities, determine continuity and recovery requirements, and maintain strategies and plans for responding to disruption. The standard treats continuity as an organizational capability that must be governed, exercised, reviewed and improved rather than as a collection of emergency documents.

Operational resilience focuses on an organization’s ability to continue delivering important business services through disruption. It expands traditional continuity thinking by examining the complete ecosystem required to deliver an important service, including people, technology, facilities, information, processes and external dependencies. This creates a business-service perspective rather than a recovery plan centred only on individual systems.

The General Data Protection Regulation establishes a comprehensive framework for protecting personal data and governing how organizations collect, use, share, retain and protect information relating to individuals. It strengthened individual rights while introducing significant organizational accountability obligations and has influenced privacy and data-protection practices far beyond the European Union.

The UAE Personal Data Protection framework establishes requirements concerning the processing and protection of personal data. It forms an important part of the UAE’s evolving digital-governance environment and requires organizations within its scope to establish clearer accountability around how personal information is collected, processed, protected, transferred and governed.

Saudi Arabia’s Personal Data Protection Law establishes requirements governing the collection, processing, use and protection of personal data. It is an important component of the Kingdom’s wider data and digital-governance environment and creates accountability requirements for organizations handling personal information across business processes, systems and external relationships.

ISO/IEC 27701 extends information-security management practices into privacy information management. It provides organizations with a structured approach for defining privacy responsibilities, establishing relevant controls and demonstrating systematic governance of personally identifiable information. It can help create a more disciplined bridge between security management and organizational privacy responsibilities.

ISO/IEC 42001 provides a management-system approach for organizations developing, providing or using artificial intelligence. It moves AI governance beyond isolated technical controls by establishing organizational responsibilities, management processes, risk considerations, lifecycle oversight and mechanisms for monitoring and continual improvement. It provides a governance foundation for organizations seeking to institutionalize responsible AI practices.

The NIST AI Risk Management Framework provides organizations with a structured approach for identifying, assessing and managing risks associated with artificial intelligence. It is intended to support trustworthy and responsible AI by integrating governance, contextual understanding, measurement and risk-management practices throughout the AI lifecycle.

Responsible AI governance establishes the organizational mechanisms needed to ensure artificial intelligence is developed and used consistently with enterprise values, risk appetite, legal obligations and stakeholder expectations. It extends beyond model performance into accountability, data governance, human oversight, transparency, explainability, security, fairness and operational impact.

The Saudi National Cybersecurity Authority Essential Cybersecurity Controls establish a structured cybersecurity baseline for organizations within their applicable scope. The controls address cybersecurity governance, defense, resilience, third-party cybersecurity and other essential areas intended to strengthen organizational and national cybersecurity capability.

The SAMA Cybersecurity Framework establishes cybersecurity governance expectations for regulated financial institutions in Saudi Arabia. It supports a structured approach to cybersecurity management, risk, controls, resilience and assurance in institutions whose technology environments are fundamental to financial services, operational stability and customer trust.

UAE information-assurance requirements provide an important governance and control reference for strengthening information security across applicable organizations and digital environments. They establish expectations around security governance, risk management, protection mechanisms, organizational responsibilities and assurance activities.

Dubai information-security requirements provide a structured approach for strengthening security governance and assurance across applicable government and digital environments. They support consistent management of cybersecurity responsibilities, controls, risk, information assets and compliance evidence within an organized governance model.