Cybersecurity Database

Cybersecurity standards and frameworks

Technical cybersecurity standards and frameworks, from security management systems to sector OT requirements. For each one you find the body, status, parts of the series and a link to the official catalogue.

Standards are protected by copyright and almost always sold: here you find metadata, an original summary and a link to the official catalogue page where they can be consulted or bought. The text is not reproduced.

Governance, management and frameworks (30)

OT and cyber-physical systems (33)

Cross-sector (ICS/SCADA) (3)

Energy, industry and water (14)

  • ANSI/AWWA G430-24Security Practices for Operation and ManagementAWWA / ANSI · Standard
  • API Std 1164Pipeline Control Systems CybersecurityAPI · Standard
  • IAEA NSS 17-T (Rev. 1)Computer Security Techniques for Nuclear FacilitiesIAEA · Industry requirementsFree
  • IEC 61511-1:2016Functional safety – Safety instrumented systems for the process industry sector – Part 1: Framework, definitions, system, hardware and application programming requirementsIEC · Standard
  • IEC 62351Power systems management and associated information exchange – Data and communications securityIEC · Series of standards
    20 parts
  • IEC 62645:2019Nuclear power plants – Instrumentation, control and electrical power systems – Cybersecurity requirementsIEC · Standard
  • IEC 62859:2016Nuclear power plants – Instrumentation and control systems – Requirements for coordinating safety and cybersecurityIEC · Standard
  • IEC 63096:2020Nuclear power plants – Instrumentation, control and electrical power systems – Security controlsIEC · Standard
  • IEC 63208:2025Low-voltage switchgear and controlgear and their assemblies – Security requirementsIEC · Standard
  • IEC TS 63074:2023Safety of machinery – Security aspects related to functional safety of safety-related control systemsIEC · Technical specification (TS)
  • IEEE 1686-2022IEEE Standard for Intelligent Electronic Devices Cybersecurity CapabilitiesIEEE · Standard
  • IEEE C37.240-2014IEEE Standard Cybersecurity Requirements for Substation Automation, Protection, and Control SystemsIEEE · StandardWithdrawn
  • ISO/IEC 27019:2024Information security, cybersecurity and privacy protection – Information security controls for the energy utility industryISO / IEC · Standard
  • NERC CIPCritical Infrastructure Protection (CIP) Reliability StandardsNERC · Industry requirementsFree
    28 parts

Transport (13)

  • CLC/TS 50701:2023Railway applications – CybersecurityCENELEC · Technical specification (TS)
  • ENCS EV-111, EV-211, EV-311EV charging infrastructure security requirementsENCS · Industry requirementsFree
    6 parts
  • EUROCAE ED-202BAirworthiness Security Process SpecificationEUROCAE / RTCA · Industry requirements
  • EUROCAE ED-203AAirworthiness Security Methods and ConsiderationsEUROCAE / RTCA · Industry requirements
  • EUROCAE ED-204AInformation Security Guidance for Continuing AirworthinessEUROCAE / RTCA · Industry requirements
  • IACS UR E26 / E27Cyber resilience of ships (UR E26) and Cyber resilience of on-board systems and equipment (UR E27)IACS · Industry requirementsFree
    2 parts
  • IEC 61162-460:2024Maritime navigation and radiocommunication equipment and systems – Digital interfaces – Part 460: Multiple talkers and multiple listeners – Ethernet interconnection – Safety and securityIEC · Standard
  • IEC 63154:2021Maritime navigation and radiocommunication equipment and systems – Cybersecurity – General requirements, methods of testing and required test resultsIEC · Standard
  • IEC 63452Railway applications – CybersecurityIEC / CENELEC · StandardUnder development ·
  • ISO 24089:2023Road vehicles – Software update engineeringISO · Standard
  • ISO/PAS 5112:2022Road vehicles – Guidelines for auditing cybersecurity engineeringISO · Publicly available specification (PAS)
  • ISO/SAE 21434:2021Road vehicles – Cybersecurity engineeringISO / SAE · Standard
  • VDA ISA 6.0.3VDA Information Security Assessment (VDA ISA)VDA / ENX · Industry requirementsFree

IoT and connected products (3)

  • EN 18031Common security requirements for radio equipmentCEN / CENELEC · Series of standards
    3 parts
    • EN 18031-1:2024 Internet connected radio equipment
    • EN 18031-2:2024 Radio equipment processing data, namely internet connected radio equipment, childcare radio equipment, toys radio equipment and wearable radio equipment
    • EN 18031-3:2024 Internet connected radio equipment processing virtual money or monetary value
  • ETSI EN 303 645CYBER; Cyber Security for Consumer Internet of Things: Baseline RequirementsETSI · StandardFree
  • ISO/IEC 27400:2022Cybersecurity – IoT security and privacy – GuidelinesISO / IEC · Standard

Health (6)

  • HITRUST CSF v11.9.0HITRUST CSFHITRUST · Cybersecurity frameworkFree
  • IEC 80001-1:2021Application of risk management for IT-networks incorporating medical devices – Part 1: Safety, effectiveness and security in the implementation and use of connected medical devices or connected health softwareIEC / ISO · Standard
  • IEC 81001-5-1:2021Health software and health IT systems safety, effectiveness and security – Part 5-1: Security – Activities in the product life cycleIEC / ISO · Standard
  • IEC TR 60601-4-5:2021Medical electrical equipment – Part 4-5: Guidance and interpretation – Safety-related technical security specificationsIEC · Technical report (TR)
  • IEC TS 81001-2-2:2025Health software and health IT systems safety, effectiveness and security – Part 2-2: Guidance for the implementation, disclosure and communication of security needs, risks and controlsIEC / ISO · Technical specification (TS)
  • ISO 27799:2025Health informatics – Information security controls in health based on ISO/IEC 27002ISO · Standard

Products, software and cryptography (16)

  • AICPA TSP Section 100 (2017 TSC, revised points of focus 2022)2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (With Revised Points of Focus – 2022)AICPA · Cybersecurity frameworkFree
  • CSA CCM v4.1Cloud Controls Matrix (CCM) and Consensus Assessments Initiative Questionnaire (CAIQ) v4.1CSA · Cybersecurity frameworkFree
  • EN 17640:2022+A1:2026Fixed-time cybersecurity evaluation methodology for ICT productsCEN / CENELEC · Standard
  • EN 17927:2023Security Evaluation Standard for IoT Platforms (SESIP) – An effective methodology for applying cybersecurity assessment and re-use for connected productsCEN / CENELEC · Standard
  • IETF RFC 9846The Transport Layer Security (TLS) Protocol Version 1.3IETF · StandardFree
  • ISO/IEC 15408 (Common Criteria)Information security, cybersecurity and privacy protection – Evaluation criteria for IT securityISO / IEC · Series of standards
    6 parts
  • ISO/IEC 19790:2025Information security, cybersecurity and privacy protection – Security requirements for cryptographic modulesISO / IEC · Standard
  • ISO/IEC 27011:2024Information security, cybersecurity and privacy protection – Information security controls based on ISO/IEC 27002 for telecommunications organizationsISO / IEC · Standard
  • ISO/IEC 27017 e 27018Information security controls and PII protection for cloud servicesISO / IEC · Series of standards
    2 parts
    • ISO/IEC 27017:2026 Information security controls based on ISO/IEC 27002 for cloud services
    • ISO/IEC 27018:2025 Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
  • ISO/IEC 27034Information technology – Application securityISO / IEC · Series of standards
    7 parts
  • NIST FIPS 140-3Security Requirements for Cryptographic ModulesNIST · StandardFree
  • NIST FIPS 203, 204 e 205Post-quantum cryptography standards (ML-KEM, ML-DSA, SLH-DSA)NIST · Series of standardsFree
    3 parts
    • FIPS 203 Module-Lattice-Based Key-Encapsulation Mechanism Standard
    • FIPS 204 Module-Lattice-Based Digital Signature Standard
    • FIPS 205 Stateless Hash-Based Digital Signature Standard
  • NIST SP 800-218 (SSDF 1.1)Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software VulnerabilitiesNIST · Cybersecurity frameworkFree
  • OWASP ASVS 5.0.0OWASP Application Security Verification StandardOWASP · Industry requirementsFree
  • OWASP MASVS v2.1.0OWASP Mobile Application Security Verification StandardOWASP · Industry requirementsFree
  • OWASP Top 10:2025OWASP Top 10:2025 – The Ten Most Critical Web Application Security RisksOWASP · Industry requirementsFree

Data, privacy and AI (10)

  • BS 10012:2017+A1:2018Data protection. Specification for a personal information management systemBSI (UK) · StandardWithdrawn
  • ETSI EN 304 223Securing Artificial Intelligence (SAI); Baseline Cyber Security Requirements for AI Models and SystemsETSI · StandardFree
  • ISO/IEC 23894:2023Information technology – Artificial intelligence – Guidance on risk managementISO / IEC · Standard
  • ISO/IEC 27040:2024Information technology – Security techniques – Storage securityISO / IEC · Standard
  • ISO/IEC 27090:2026Cybersecurity – Artificial intelligence (AI) – Addressing security threats and compromises to AI systemsISO / IEC · Standard
  • ISO/IEC 27701:2025Information security, cybersecurity and privacy protection – Privacy information management systems – Requirements and guidanceISO / IEC · Standard
  • ISO/IEC 29100:2024Information technology – Security techniques – Privacy frameworkISO / IEC · Standard
  • ISO/IEC 42001:2023Information technology – Artificial intelligence – Management systemISO / IEC · Standard
  • NIST AI RMF 1.0Artificial Intelligence Risk Management Framework (AI RMF 1.0)NIST · Cybersecurity frameworkFree
  • NIST Privacy Framework 1.0NIST Privacy Framework: A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0NIST · Cybersecurity frameworkFree

OT/CPS documents in the database (25) · Open data (JSON)