Compliance and standards
Recognised frameworks, assessed against one shared control library.
Cyber Guys does not treat each standard as a separate project. Every framework maps onto the same set of controls, so answering a question once satisfies it everywhere it applies — and the evidence you attach is visible everywhere too.
- 13 frameworks with authored, assessable content
- 375 individual requirements covered
- 65 master controls, 504 cross-framework mappings
- 6 of them Australian
You answer once
“Multi-factor authentication is enforced for all users”
Every framework in the library maps onto one shared control set, so evidence you collect for one standard counts towards the others instead of being re-gathered.
- Assessable frameworks
- 13
- Requirements covered
- 375
- Master controls
- 65
- Cross-framework mappings
- 504
Australian frameworks
Built for what you get asked about here.
These are the reference points Australian insurers, tender panels, regulators and grant programmes actually use.
Cyber Guys Small Business Baseline
Australian- Requirements assessed
- 64
- Covered by mapped controls
- 64
ASD Essential Eight Maturity Model
Australian- Requirements assessed
- 24
- Covered by mapped controls
- 24
Australian Privacy Principles and Notifiable Data Breaches
Australian- Requirements assessed
- 21
- Covered by mapped controls
- 21
ASD Information Security Manual
Australian- Requirements assessed
- 12
- Covered by mapped controls
- 12
APRA Prudential Standard CPS 234 Information Security
Australian- Requirements assessed
- 11
- Covered by mapped controls
- 9
Cyber Insurance Readiness
Australian- Requirements assessed
- 10
- Covered by mapped controls
- 10
International frameworks
For the standards your customers and partners bring with them.
Global standards, mapped onto the same control library so they cost you far less than assessing against each one separately.
NIST Cybersecurity Framework 2.0
- Requirements assessed
- 68
- Covered by mapped controls
- 68
CIS Critical Security Controls v8.1
- Requirements assessed
- 55
- Covered by mapped controls
- 55
ISO/IEC 27001:2022 readiness
- Requirements assessed
- 51
- Covered by mapped controls
- 47
PCI DSS v4.0.1 readiness and scope tracking
- Requirements assessed
- 21
- Covered by mapped controls
- 15
NIST AI Risk Management Framework 1.0
- Requirements assessed
- 18
- Covered by mapped controls
- 18
ISO/IEC 42001 AI management system readiness
- Requirements assessed
- 12
- Covered by mapped controls
- 11
ISO/IEC 27701 privacy information management readiness
- Requirements assessed
- 8
- Covered by mapped controls
- 8
Being precise
Readiness, alignment and gap assessment — not certification.
Cyber Guys is not a certification body.
It issues no accreditation against any standard on this page. Where a framework has a formal certification path — ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 — that requires an accredited external body engaged separately from us.
Some frameworks have no certification at all.
There is no NIST CSF certification and no official CSF score. Anyone offering to certify you against CSF is describing their own scheme, not NIST’s. The platform treats CSF the way it is designed to be used: a current profile compared against a target profile you choose.
Regulatory frameworks carry legal obligations we cannot assess.
The Australian Privacy Principles, the Notifiable Data Breaches scheme and APRA CPS 234 are law and prudential regulation. The platform helps you organise, evidence and track your position. It does not tell you whether you have met a legal obligation, and it is not a substitute for legal advice.
Advanced profiles are offered only where they apply.
An applicability questionnaire determines which frameworks are relevant to your organisation. Regulatory profiles like APRA CPS 234 and PCI DSS are only offered to organisations they actually apply to, rather than being sold to everybody as a scare tactic.
On the roadmap
Frameworks in the registry without content yet.
The framework registry is data-driven, so adding a standard is authorship rather than engineering. These entries exist and can be authored without a code change — but they have no requirement content today, so we are not going to count them as supported.
These are all United States frameworks, kept in the registry for organisations with US customers or operations. They are deliberately excluded from the counts on this site.
Start somewhere
Most Australian businesses start with two.
The Essential Eight, because it is what everyone asks about, and cyber-insurance readiness, because the renewal is usually what forced the conversation.
Not sure which framework applies to you?
Tell us your industry, size and who is asking. We will tell you which one to start with, and whether you need any of the others.