Standards and regulation in OdySecure, the security platform by Cybervize

Standards and regulatory requirements: 50 frameworks in one platform

We keep 50 frameworks as a catalogue in the platform, 21 standards and 29 regulatory requirements; the list below shows the documented state, and the catalogue keeps growing. The distinction is not hair-splitting: a standard you choose, a regulatory requirement applies to you. The platform treats each differently.

Book a free demo

The catalogue at a glance

50frameworks

21 Standards29 Regulations

Catalogue depth: Full-text catalogue31; Reference structure18; BSI catalogue1
Own assurance scheme: Certification13; Attestation6; Assessment label1; Conformity assessment1; no own scheme29

1,471 requirement records in the catalogue

How to read the catalogue

Full-text catalogue: Requirement text of freely available legal acts and standards.
Reference structure: Licensed standards with reference codes and short titles, without the standard's text.
BSI catalogue: BSI Grundschutz++ as a catalogue of its own.; Assurance: how the framework itself evidences conformity. Empty means it has no scheme of its own.; Records: requirements in the Cybervize catalogue. A framework can have more articles or clauses.

50 results

Standards and frameworks (21)

Freely selectable frameworks, depending on the assurance model: certification (ISO), attestation (SOC 2), assessment label (TISAX) or reference mapping, with maturity and applicability view (for ISO 27001 the formal statement of applicability).

ISO/IEC 27001
Information security management system, the platform's shared language
Catalogue depthReference structure
AssuranceCertification
Records123
ISO/IEC 42001
Management system for artificial intelligence
Catalogue depthReference structure
AssuranceCertification
Records70
ISO 22301:2019
Business continuity management
Catalogue depthReference structure
AssuranceCertification
Records26
ISO/IEC 27701:2025
Standalone privacy information management system, integrable with ISO/IEC 27001
Catalogue depthReference structure
AssuranceCertification
Records35
ISO/IEC 27005:2022
Information security risk management
Catalogue depthReference structure
Assurance: no own scheme
Records15
ISO/IEC 27017:2015
Security controls for cloud services
Catalogue depthReference structure
Assurance: no own scheme
Records7
ISO/IEC 27019:2024
Information security for energy utilities
Catalogue depthReference structure
Assurance: no own scheme
Records12
ISO/IEC 27036-2:2022
Information security in supplier relationships, requirements
Catalogue depthReference structure
Assurance: no own scheme
Records10
ISO/IEC 27036-3:2023
Security of the hardware, software and services supply chain
Catalogue depthReference structure
Assurance: no own scheme
Records12
IEC 62443 (parts 2-1, 3-2, 3-3, 4-1 and 4-2)
Security of industrial automation, OT and ICS
Catalogue depthReference structure
AssuranceCertification
Records37
ISO/SAE 21434:2021
Road vehicle cybersecurity
Catalogue depthReference structure
Assurance: no own scheme
Records11
CLC/TS 50701:2023
Railway application cybersecurity
Catalogue depthReference structure
Assurance: no own scheme
Records19
NIST CSF 2.0
Cybersecurity framework, function-based governance
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records106
NIST SP 800-53 Rev 5
Extensive control catalogue with baselines
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records158
NIST AI RMF 1.0
Risk management for AI systems
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records19
TISAX / VDA ISA 6
Information security in the automotive supply chain
Catalogue depthReference structure
AssuranceAssessment label
Records43
SOC 2 / Trust Services Criteria
Assessment criteria for service providers
Catalogue depthReference structure
AssuranceAttestation
Records44
PCI DSS v4.0.1
Security in card payment processing
Catalogue depthReference structure
AssuranceAttestation
Records12
CIS Controls v8.1
Prioritised security controls for operational implementation
Catalogue depthReference structure
Assurance: no own scheme
Records18
BSI C5:2026
The German BSI's cloud security criteria, audit report per ISAE 3000 / IDW PS 951; applicable to type 1 reports dated on or after 1 June 2027 and type 2 periods starting from that date, earlier adoption permitted; a type 2 period that begins before and ends after it runs under C5:2020 only
Catalogue depthReference structure
AssuranceAttestation
Records174
BSI Grundschutz++
State-of-the-art library of the German BSI
Catalogue depthBSI catalogue
Assurance: no own scheme
Records

Regulatory requirements (29)

Legal acts and supervisory requirements that apply to affected organisations: with obligations, deadlines and auditable evidence.

EU cybersecurity law

NIS2 Directive
EU framework for network and information security
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records11
NIS2 Implementing Regulation (EU) 2024/2690
Technical implementing rules for certain digital services and ICT providers (cloud, data centres, MSP/MSSP, DNS, trust services, online platforms)
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records49
German BSI Act 2025 (NIS2UmsuCG)
German transposition, operator obligations
Catalogue depthFull-text catalogue
AssuranceAttestation
Records18
KRITIS Umbrella Act
Physical and digital protection of critical infrastructure
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records16
CER Directive (EU) 2022/2557
Resilience of critical entities
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records14
Cyber Resilience Act (EU) 2024/2847
Security requirements for products with digital elements; the assessment route depends on the product class and on whether harmonised standards are applied
Catalogue depthFull-text catalogue
AssuranceConformity assessment
Records44
DORA (EU) 2022/2554
Digital operational resilience in the financial sector (framework regulation; the RTS and ITS that flesh it out are listed below as their own catalogues)
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records21

DORA level 2: RTS and ITS

DORA RTS ICT risk management (EU) 2024/1774
Technical standards for the ICT risk management framework
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records30
DORA RTS incident classification (EU) 2024/1772
Criteria and thresholds for classifying ICT-related incidents
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records18
DORA RTS/ITS incident reporting (EU) 2025/301 and 2025/302
Content, deadlines and forms for reporting major ICT incidents
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records12
DORA RTS ICT third-party contracts (EU) 2024/1773
Contract policy for ICT services supporting critical or important functions
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records20
DORA ITS register of information (EU) 2024/2956
Reporting format for the register of ICT contractual arrangements
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records12
DORA RTS subcontracting (EU) 2025/532
Conditions for subcontracting ICT services for critical functions
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records16
DORA RTS TLPT (EU) 2025/1190
Threat-led penetration testing
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records16

Data, identity and AI

GDPR (EU) 2016/679
Protection of personal data
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records23
EU Data Act (EU) 2023/2854
Access to and use of data
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records22
eIDAS 2.0 (Regulation (EU) 2024/1183)
European framework for digital identity and trust services, amending Regulation (EU) No 910/2014
Catalogue depthFull-text catalogue
AssuranceCertification
Records18
EU AI Act (EU) 2024/1689
Requirements for AI systems by risk class
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records20

Sector-specific requirements

IT security catalogue energy (EnWG)
Grid operators, German BNetzA
Catalogue depthFull-text catalogue
AssuranceCertification
Records15
TKG security requirements
Telecommunications providers
Catalogue depthFull-text catalogue
AssuranceAttestation
Records15
MaRisk, 9th amendment
Supervisory requirements for banks
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records14
EASA Part-IS
Information security in aviation
Catalogue depthFull-text catalogue
AssuranceCertification
Records17
Maritime Cyber Risk (IMO MSC.428(98))
Cyber risk management in shipping
Catalogue depthFull-text catalogue
AssuranceCertification
Records17
SGB V Section 391
IT security in hospitals
Catalogue depthFull-text catalogue
Assurance: no own scheme
Records8
Metering Point Operation Act (MsbG)
Smart meter gateway
Catalogue depthFull-text catalogue
AssuranceCertification
Records13
UN Regulation No. 155
Cybersecurity management system for vehicles
Catalogue depthFull-text catalogue
AssuranceCertification
Records14
UN Regulation No. 156
Software update management system for vehicles
Catalogue depthFull-text catalogue
AssuranceCertification
Records10
B3S water/wastewater
Sector standard for critical water infrastructure
Catalogue depthReference structure
AssuranceAttestation
Records9
RED cybersecurity
Radio Equipment Directive, cyber articles
Catalogue depthFull-text catalogue
AssuranceCertification
Records8

A catalogue that belongs to the platform

The frameworks are not a list on a slide: they live inside the ISMS, BCM, Assessment and TPRM modules, on one data layer with permission model and audit trail. See how the platform turns them into controls, maturity levels and evidence.

See OdySecure

In an intro call, a vCISO works out which of these requirements apply to your organisation and what follows from them, using exactly this catalogue.

No CISO of your own?

In a vCISO mandate, your vCISO works with OdySecure and the platform is included. From €3,600/month.

Book an intro call vCISO in detail

More about standards and regulation

Implement once, evidence many times

ISO 27001 is the platform's shared control base. Security and governance requirements map onto it via crosswalk where technically feasible: a control implemented once serves several frameworks at the same time, without duplicate maintenance. Legal, reporting, registration and procedural obligations that cannot be mapped are managed in their own right. Each activated standard gets its own applicability and maturity view; the formal statement of applicability belongs to ISO 27001. New frameworks are integrated as data, not as custom development. And an honest limit: crosswalks reduce duplicate work, but they do not replace an individual review of scope, exceptions and evidence obligations.

Standard or requirement: why the distinction matters

You choose a standard to be measured against it: ISO 27001, IEC 62443, SOC 2. You decide on scope and certification goal. A regulatory requirement applies to you whether you like it or not: NIS-2, DORA, GDPR, the German BSI Act. Here what counts is not the certificate but demonstrable compliance. In the platform, standards lead to catalogue, controls, statement of applicability and maturity; regulatory requirements lead to obligations, deadlines, reporting paths and evidence. ISO 27001 is the shared control base: security and governance requirements map onto it via crosswalk where technically feasible, so a control implemented once serves several frameworks at the same time. Obligations that cannot be mapped as controls, such as registrations, reporting deadlines or communication with authorities, are managed in their own right.

What “in the catalogue” actually means

The numbers below are requirement records in the Cybervize catalogue as of July 2026, not the total number of articles or clauses in a framework. Per legal act, the catalogue covers the obligations relevant to security, governance, privacy and resilience processes; its size may differ from the total number of articles. For freely accessible legal acts and standards (legal texts, NIST) we keep a full-text requirement catalogue. Licensed standards (ISO, IEC, TISAX, PCI, SOC 2) we keep as a reference structure with reference codes and short titles, without the standard text, so that usage stays licence-compliant. The BSI Grundschutz++ is kept as its own catalogue. How we count, using BSI C5:2026 as the example: we count the unique criterion codes of the form prefix-number in the original document. The table of contents and the section headings independently both yield 174. Other sources state 168; the difference probably rests on a different boundary between main, additional and technical sub-criteria. We give the figure that follows from the document itself and name the method so you can recount it.

And the entry point for smaller organisations

Small and mid-sized companies can also use DIN SPEC 27076 as an interview-based assessment questionnaire with an additive scoring system. It is not a regulatory framework but a low-threshold entry into site assessment, and it is imported like other catalogues via OSCAL.

What is deliberately not in the catalogue

We do not put anything into the catalogue that we cannot verify or that carries no operator obligations of its own. Two documented examples and the reasons:

ISO/IEC 27018:2025

The only item that would need its own curation is the extended control annex, whose reference codes are not publicly accessible. According to the standard's foreword, the main clauses are identical to ISO/IEC 27002:2022 and therefore already covered via the ISO 27001 catalogue.

Pure audit and methodology standards (ISO 27006, 27007, 19011, 17021, ISO 31000)

They describe audit and methodology procedures but carry no operator obligations of their own; as catalogue rows they would dilute the statement of applicability. They therefore sit in the backlog, not in the catalogue.

FAQ about standards and regulation

What is the difference between a standard and a regulatory requirement?▼

You choose a standard voluntarily to be measured against a recognised benchmark, such as ISO 27001 or IEC 62443; the result is typically a certificate or a maturity level. A regulatory requirement such as NIS-2, DORA or GDPR applies to affected organisations by law or supervision; here what counts is demonstrable compliance, not certification. In the platform both are treated differently: standards as a catalogue with controls and statement of applicability, requirements as obligations with deadlines and evidence.

What does it concretely mean that a framework is “in the catalogue”?▼

It means the framework's requirements are stored as structured records in the platform, so controls, measures and evidence can be attached to them. For freely accessible legal acts and standards we keep the curated requirements in full text. Licensed standards we keep as a reference structure with codes and short titles, without the standard text, so that usage stays licence-compliant. Whether and when you activate a framework is decided per tenant.

Why do some standards not show full requirement texts?▼

Standards from ISO, IEC or bodies such as the VDA and the PCI authority are copyrighted and paid. We are not allowed to reproduce their standard text. That is why we keep them as a reference structure: with the official reference codes and short titles to which you attach your implementation, but without the licensed wording. Legal acts and freely accessible frameworks such as the NIST catalogues, by contrast, we keep with the full text of the curated requirements.

Are the DORA implementing acts (RTS and ITS) included as well?▼

Yes. Alongside the DORA framework regulation we keep the level-2 acts (RTS and ITS) as seven catalogues of their own: ICT risk management, incident classification, incident reporting, the contract policy for ICT third-party providers, the register of information on ICT contractual arrangements, subcontracting of critical ICT services, and threat-led penetration testing (TLPT). Financial entities work directly against the concrete technical requirements, not just the framework text.

Does the platform also cover sector-specific requirements?▼

Yes. Alongside the EU core law, sector-specific requirements are stored: the energy IT security catalogue under EnWG, the TKG security requirements, MaRisk for banks, EASA Part-IS for aviation, the IMO requirements for shipping, SGB V Section 391 for hospitals, the Metering Point Operation Act for smart meters, UN Regulations 155 and 156 for vehicles, and the B3S sector standard for water.

What happens when a new framework is added?▼

New frameworks are integrated as data into the catalogue, not programmed as custom development. Via OSCAL import, control catalogues can be read in machine-readably, custom catalogues can also be created directly in the platform, and the crosswalk onto ISO 27001 ensures that a control already implemented also covers the new framework. This way the catalogue grows with regulation, without you maintaining things twice.

Memberships, programmes and partnerships