Framework translation
One finding. Many reporting languages.
Security findings mapped to the frameworks and regulations you report against.
Every FlowCraft AI finding can be mapped to the framework you report against: 108 frameworks, standards, regulations and maturity models across global best practice, the GCC, EMEA, the Americas and Asia-Pacific. NIST CSF 2.0, ISO/IEC 27001, CIS Controls and MITRE ATT&CK mappings are kept alongside your primary framework.
39Cyber Security Best Practice
FlowCraft AI baselines, Global standards, Public control library39 frameworks
FlowCraft AI baselines
- Flowcraft Cyber Security Best Practice (NIST CSF 2.0 + ISO 27001 + CIS v8.1)
- Flowcraft General Governance Check (ISO 27014 + COBIT 2019 + ISO 38500)
Global standards
- NIST CSF 2.0
- ISO/IEC 27001:2022
- ISO/IEC 27002:2022
- NIST SP 800-53 Rev. 5
- CIS Controls v8.1
- MITRE ATT&CK
- NIST SP 800-207 Zero Trust Architecture
- ISO/IEC 27017 (cloud) + ISO/IEC 27018 (cloud privacy)
- ISO/IEC 27701 Privacy Information Management
- ISO 22301:2019 Business Continuity
- ISO/IEC 42001:2023 AI Management System
- NIST AI RMF 1.0
- CSA Cloud Controls Matrix v4
- PCI DSS v4.0.1
- SOC 2 (AICPA Trust Services Criteria)
- OWASP ASVS
- ISA/IEC 62443 (OT / ICS)
Public control library
- NIST SP 800-171 Rev. 3
- NIST SP 800-61 Rev. 3 (Incident Response)
- NIST SP 800-218 SSDF
- NIST SP 800-190 (Container Security)
- NIST Privacy Framework
- NIST AI 600-1 Generative AI Profile
- CISA Cross-Sector Cybersecurity Performance Goals
- CISA Secure by Design
- MITRE D3FEND
- MITRE ATLAS (AI systems)
- Microsoft Cloud Security Benchmark
- AWS Well-Architected Security Pillar
- Google Cloud Enterprise Foundations
- OWASP SAMM 2.2
- OWASP Top 10:2025
- OWASP API Security Top 10
- OWASP Top 10 for LLM Applications
- SLSA v1.2 (Supply-chain Levels for Software Artifacts)
- NIST SP 800-82 Rev. 3 (OT Security)
- MITRE ATT&CK for ICS
4Maturity Models (CMM)
Capability maturity models4 frameworks
Capability maturity models
- SOC-CMM (SOC Capability Maturity Model)
- C2M2 v2.1 (Cybersecurity Capability Maturity Model)
- CMMC 2.0 (Cybersecurity Maturity Model Certification)
- CMMI v3.0 (Capability Maturity Model Integration)
7General Governance
Governance and risk7 frameworks
Governance and risk
- COBIT 2019
- ISO/IEC 27014:2020 Governance of Information Security
- ISO/IEC 38500 Governance of IT
- ISO 31000:2018 Risk Management
- COSO Internal Control and ERM
- ITIL 4 (service management)
- ISO/IEC 20000-1:2018 IT Service Management
32GCC
United Arab Emirates, Saudi Arabia, Qatar, Bahrain, Oman, Kuwait32 frameworks
United Arab Emirates
- UAE IA Standard V2 (UAE Cyber Security Council)
- UAE IA Regulation (NESA / TDRA, legacy)
- UAE Cyber Security Council national policies and standards
- UAE PDPL (Federal Decree-Law 45 of 2021)
- Dubai DESC Information Security Regulation (ISR) v3
- Dubai DESC Cloud Service Provider Security Standard
- ADHICS (Healthcare Information and Cyber Security Standard)
- CBUAE (Central Bank) technology and cyber risk requirements
- DIFC Data Protection Law 2020
- ADGM Data Protection Regulations 2021
Saudi Arabia
- NCA Essential Cybersecurity Controls (ECC-2:2024)
- NCA Cloud Cybersecurity Controls (CCC-2:2024)
- NCA Data Cybersecurity Controls (DCC-1:2022)
- NCA Critical Systems Cybersecurity Controls (CSCC-1:2019)
- NCA Operational Technology Cybersecurity Controls (OTCC-1:2022)
- NCA Telework Cybersecurity Controls (TCC-1:2021)
- SAMA Cyber Security Framework
- Saudi PDPL (SDAIA) + NDMO data management standards
- CST Cybersecurity Regulatory Framework (ICT providers)
Qatar
- Qatar National Information Assurance Standard (NIAS v2.1)
- Qatar Personal Data Privacy Protection Law (Law 13 of 2016)
- Qatar Central Bank technology and cyber risk requirements
Bahrain
- Bahrain NCSC national cyber security standards
- CBB Rulebook - Operational Risk / Cyber Security Risk Management
- Bahrain PDPL (Law 30 of 2018)
Oman
- Oman Basic Security Controls (MTCIT / OCERT)
- Oman PDPL (Royal Decree 6/2022)
- Central Bank of Oman cyber security requirements
Kuwait
- Kuwait National Basic Cybersecurity Controls (NBCC)
- Kuwait National Cybersecurity Framework (NCSC)
- CITRA Data Privacy Protection Regulation
- Central Bank of Kuwait Cybersecurity Framework
23EMEA
European Union, United Kingdom, Rest of Europe, Middle East (non-GCC), Africa23 frameworks
European Union
- EU NIS2 Directive (2022/2555)
- EU DORA (Regulation 2022/2554)
- EU GDPR (Regulation 2016/679)
- EU AI Act (Regulation 2024/1689)
- EU Cyber Resilience Act (Regulation 2024/2847)
- EU Critical Entities Resilience Directive (2022/2557)
United Kingdom
- NCSC Cyber Assessment Framework (CAF) v4.0
- Cyber Essentials / Cyber Essentials Plus
- UK GDPR and Data Protection Act 2018
- UK NIS Regulations 2018 (and Cyber Security and Resilience Bill)
Rest of Europe
- Germany BSI IT-Grundschutz
- TISAX (VDA ISA) - automotive
- France ANSSI hygiene guide / SecNumCloud
- Spain Esquema Nacional de Seguridad (ENS)
- Switzerland FINMA operational resilience / nDSG
Middle East (non-GCC)
- Egypt Personal Data Protection Law (Law 151 of 2020)
- Turkiye KVKK + Information and Communication Security Guide
- Jordan National Cyber Security Center framework
- Israel INCD Cyber Defense Methodology 2.0
Africa
- South Africa POPIA
- Nigeria Data Protection Act 2023 + CBN Risk-based Cybersecurity Framework
- Kenya Data Protection Act 2019
- Morocco DNSSI / Law 05-20 cybersecurity
3Americas & Asia-Pacific
United States, Australia3 frameworks
United States
- HIPAA Security Rule
- NERC CIP Standards (bulk electric system)
Australia
- ASD Essential Eight
Control mapping organises evidence; it does not confer certification or constitute a legal opinion on compliance. Licensed standards such as ISO/IEC 27001 are referenced by control identifier only, and their text is used only where you supply an authorised copy. Regulatory versions change without notice; we confirm the current version at scoping.
Report against your framework, not ours.
Tell us which framework, regulator or maturity model you answer to. We map the assessment to it from the start.