Standards · Turn standards into action
Standards, frameworks and regulations, made clear.
A security standard, an audit framework, an assurance methodology, a certification scheme and a regulation are different things. The StreamLight standards library keeps them distinct, summarizes each one and links to the official source.
Know what you are dealing with
Not all requirements are equal.
Security standard
A published specification of requirements or controls, usually voluntary.
Framework
A structured approach or set of practices an organization adopts.
Regulation
A legal obligation that applies by law within its scope.
Audit framework
Criteria and processes used to examine an organization.
Assurance methodology
How an independent practitioner reaches and reports a conclusion.
Certification scheme
A process by which an accredited body certifies conformity.
Guidance & industry requirements
Good-practice guidance and sector-specific requirements.
Organizational policy
Your own requirements, set and owned internally.
Security standards & frameworks
Security standards, frameworks and regulations.
Audit Argus provides controls, mappings and workflows designed to support alignment with the following.
| Name | Issuing organization | Type | Focus |
|---|---|---|---|
| ISO/IEC 27001 | ISO / IEC | Standard | Information security management system requirements. |
| ISO/IEC 27002 | ISO / IEC | Guidance | Guidance on information security controls. |
| NIST Cybersecurity Framework | NIST | Framework | Outcomes for managing cybersecurity risk. |
| NIST SP 800-53 | NIST | Control catalog | Security and privacy controls for information systems. |
| CIS Controls | Center for Internet Security | Framework | Prioritized set of cyber-defence safeguards. |
| CIS Benchmarks | Center for Internet Security | Guidance | Secure configuration baselines. |
| SOC 2 Trust Services Criteria | AICPA | Audit criteria | Criteria for security, availability, processing integrity, confidentiality and privacy. |
| PCI DSS | PCI Security Standards Council | Industry requirement | Protection of payment card data. |
| HIPAA security requirements | U.S. Department of Health & Human Services | Regulation | Safeguards for electronic protected health information. |
| CSA Cloud Controls Matrix | Cloud Security Alliance | Framework | Cloud-specific security controls. |
| OWASP ASVS | OWASP | Standard | Application security verification requirements. |
| OWASP API Security / Top 10 | OWASP | Guidance | Common application and API security risks. |
| DORA | European Union | Regulation | Digital operational resilience for the financial sector. |
| NIS2 | European Union | Directive | Cybersecurity obligations for essential and important entities. |
| GDPR (security obligations) | European Union | Regulation | Security of processing of personal data. |
| CCPA / CPRA | State of California | Law | Consumer privacy rights, where applicable. |
Audit & assurance
How organizations are examined.
Audit and assurance frameworks describe how an organization is assessed, which is different from the standard it is assessed against.
| Name | Type | What it is |
|---|---|---|
| SOC 2 | Attestation | An examination by an independent CPA firm, reported against the AICPA Trust Services Criteria. |
| AICPA Trust Services Criteria | Audit criteria | The criteria a SOC 2 examination evaluates. |
| ISO/IEC 27001 audit and certification lifecycle | Certification scheme | Certification audits, surveillance audits and recertification by accredited certification bodies. |
| ISO 19011 | Guidance | Guidelines for auditing management systems. |
| ISAE 3000 | Assurance methodology | An international standard for assurance engagements other than audits of historical financial information. |
| Internal audit programs | Internal | Your organization’s own audit plans and assessments. |
| Customer-specific audit programs | Contractual | Audits and assessments required by customers. |
| Organizational control assessments | Internal | Self-assessment and control testing programs. |
| Custom audit frameworks | Internal | Any audit program you define. |
StreamLight is not an auditor or certification body. Audit Argus helps you prepare for, run and evidence audits that are performed by independent, qualified assessors.
AI governance
AI governance standards and frameworks.
| Name | Issuing organization | Type | Focus |
|---|---|---|---|
| ISO/IEC 42001 | ISO / IEC | Standard | AI management system. |
| NIST AI RMF | NIST | Voluntary framework | AI risk management: Govern, Map, Measure, Manage. |
| NIST Generative AI Profile | NIST | Guidance | Generative AI risk-management guidance. |
| ISO/IEC 23894 | ISO / IEC | Guidance | AI risk management guidance. |
| ISO/IEC 22989 | ISO / IEC | Standard | AI concepts and terminology. |
| ISO/IEC 23053 | ISO / IEC | Standard | Framework for AI systems using machine learning. |
| EU AI Act | European Union | Regulation | AI regulatory requirements where applicable. |
| OWASP AI / LLM security guidance | OWASP | Guidance | AI and LLM application security. |
| Organizational AI governance | Your organization | Internal | Custom requirements, policies and controls. |
Voluntary standards and frameworks are distinct from laws and regulations. Implementing a framework does not by itself establish legal compliance.
Framework library
Structured, summarized and sourced.
Each entry in the library follows the same structure. We publish summaries and metadata and link to the official source; we do not reproduce copyrighted standards.
- Name & issuing organizationWho publishes it.
- Version & typeStandard, framework, regulation or guidance.
- Description & applicabilityWhat it covers and who it applies to.
- RequirementsSummarized requirement structure.
- Related controls & crosswalksMappings to other frameworks.
- StreamLight support & official sourceWhat Audit Argus provides, and where to read the original.
Crosswalks
One control. Multiple standards.
Security crosswalk
AI crosswalk
Continuous assurance
Complex standards. Clear actions. Continuous assurance.
See how Audit Argus turns your frameworks into continuously tested controls, with evidence you can trace from every result back to its source.