Compliance frameworks

Safeguard's framework library has 373 frameworks: national data-protection, cybersecurity and sector laws, industry standards such as SOC2, ISO/IEC 27001 and PCI DSS, and Safeguard's own supply-chain policies. This page explains how Safeguard covers a framework, what its readiness score counts, and how to choose the frameworks your organization works on. Every framework has its own page, grouped by region below.

How Safeguard covers a framework

1. Scan requirements. Every framework has a set of requirements that Safeguard checks on each scan of a product, against what the scan found, including the product's software inventory (SBOM). There are 2,207 in all. A framework's page lists its requirements and what Safeguard checks for each.
2. Controls. On a framework's Controls tab, its scan requirements appear as controls. For 197 frameworks Safeguard's control catalog adds more of the framework's controls (2,197 in all), which you evidence with automated tests, uploaded evidence, policies and attestations.
3. Automated tests. Systems you connect (cloud accounts, identity providers, code hosts and many more) run automated tests that map to the controls of SOC2, ISO/IEC 27001, the HIPAA Security Rule, PCI DSS and NIST CSF 2.0, and to the CIS benchmarks. Through the crosswalk, that evidence also reaches equivalent controls of the related frameworks, including NIST SP 800-53. For every other framework you can link tests to its controls yourself. See Frameworks and connectors.
4. Policy templates. Every framework has policy templates to start from: the standard set, adapted to that framework, and for 197 frameworks more templates written for it specifically.

Automated tests map directly to 6 frameworks in the library. For most frameworks, coverage is the scan requirements, the controls and your own evidence.

Decided by a scan, or by evidence

A scan decides a requirement when it can see what the requirement asks for. Of the 2,207 scan requirements:

• 2,086 are decided by a scan: met or not met.
• 10 are checked by a scan for a prerequisite. A missing prerequisite fails the requirement; only evidence or an attestation passes it.
• 111 need evidence a scan cannot see, such as a policy, an HR record or an access review. They pass when a person attests them with evidence.

Each framework's page marks every requirement with which of these it is.

What a readiness score counts

A framework's readiness score is the share of its in-scope requirements that pass:

• A requirement passes on a scan that finds it met, or on an attestation by a person that names its evidence.
• A requirement waiting for evidence counts as not yet passing. It stays in the score until someone attests it.
• A requirement a person scopes out, with a written justification, leaves the score.
• The score reads 100 only when every in-scope requirement passes.
• Beside every score, Safeguard shows how many requirements a scan evaluated and how many need evidence or an attestation.

A readiness score is Safeguard's assessment of what it can see. It is not an audit opinion or a certification.

Choose your frameworks

1. Open Compliance › Manage, then the Frameworks tab.
2. Find a framework by region, country, industry or type, or search for it.
3. Switch it on, then select Save. It appears on Compliance › Frameworks, Controls and Overview.

Out of the box, every framework is switched on except the 176 national data-protection and cybersecurity laws: switch on the ones that apply to you. Your Safeguard plan decides which frameworks your organization can choose from, and your Safeguard administrator manages that list. Choosing a framework does not certify compliance.

Policy templates

Every framework in the library has these 22 policy templates, adapted to that framework:

• Information Security Policy
• Access Control Policy
• Acceptable Use Policy
• Data Protection & Privacy Policy
• Incident Response Policy
• Business Continuity & Disaster Recovery Policy
• Third-Party / Vendor Risk Management Policy
• Change Management Policy
• Vulnerability & Patch Management Policy
• Logging & Monitoring Policy
• Encryption & Cryptography Policy
• Risk Assessment & Management Policy
• Secure Software Development Policy
• Asset Management Policy
• Security Awareness & HR Security Policy
• Backup & Data Retention Policy
• Network Security Policy
• Data Classification & Handling Policy
• Password & Authentication Policy
• Physical & Environmental Security Policy
• AI & Responsible Use Policy
• Penetration Testing & Security Assessment Policy

Where a framework has its own template on the same subject, that one replaces the standard one. To use a template, open the framework on Compliance › Frameworks, then its Policies tab, select New policy and choose Start from template.

Frameworks by region

The full list on one page: All frameworks.