Compliance frameworks Lavawall® supports

Lavawall maps, assesses, and keeps evidence current for the frameworks below. Search or pick a region, then open yours for the requirements, the assessment tiers, and how Lavawall automates the technical controls.

Security & governance

CIS Controls v8 8.1

Center for Internet Security Critical Security Controls Version 8.

Region: Global (applies anywhere)

Canadian Program for Cyber Security Certification (CPCSC) ITSP.10.171 Oct 2025; Level 1 Apr 2026

Canadian Program for Cyber Security Certification, run by Public Services and Procurement Canada for defence suppliers.

Region: Canada

NIST Cybersecurity Framework (NIST CSF) 2.0

The NIST Cybersecurity Framework provides a policy framework of computer security guidance for how organizations can assess and improve their ability to prevent, detect, and respond to cyber attacks.

Region: Global (applies anywhere)

NIST SP 800-171 r3

Protecting Controlled Unclassified Information in Nonfederal Systems

Region: United States

Canadian Centre for Cyber Security Guidance 2024

Baseline Cyber Security Controls for Small and Medium Organizations from the Canadian Centre for Cyber Security.

Region: Canada

COBIT 2019 2019

ISACA COBIT 2019 framework for governance and management of enterprise information and technology.

Region: Global (applies anywhere)

ITIL 4 4

ITIL 4 framework for IT service management.

Region: Global (applies anywhere)

Ontario Cyber Security Framework 2024

Ontario government cybersecurity framework for public sector organizations.

Region: Ontario, Canada

ISO/IEC 27001 2022

ISO/IEC 27001 is an international standard for information security management systems (ISMS).

Region: Global (applies anywhere)

Sarbanes-Oxley Act (SOX) 2002

Sarbanes-Oxley Act of 2002 — US federal law requiring publicly traded companies to maintain internal controls over financial reporting (ICFR).

Region: United States

C-SOX (Canadian Securities NI 52-109) 2023

Canadian equivalent of Sarbanes-Oxley, implemented through National Instrument 52-109 — Certification of Disclosure in Issuers Annual and Interim Filings.

Region: Canada

EU NIS2 Directive 2024

Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union.

Region: European Union

CMMC v2.0

Cybersecurity Maturity Model Certification - Required for DoD contractors handling CUI/FCI.

Region: United States

UK Cyber Essentials 2025

UK government-backed Cyber Essentials certification scheme (Willow update, effective April 2025).

Region: United Kingdom

EU Cyber Resilience Act (CRA) 2024

Regulation (EU) 2024/2847 — Cyber Resilience Act, entered into force 10 December 2024.

Region: European Union

SOC 2 2024

SOC 2 Trust Services Criteria — Type I (point-in-time design assessment) and Type II (operating effectiveness over a period, typically 6-12 months).

Region: Global (applies anywhere)

IEC 81001-5-1 Health Software Security Life Cycle 2021

The standard that defines what a secure development life cycle looks like for health software and health IT, published 2021.

Region: Global (applies anywhere)

ANSI/AAMI SW96 Medical Device Security Risk Management 2023

The American National Standard for security risk management of medical devices, published November 2023, together with AAMI TIR57:2016/(R)2023, the technical information report it builds on.

Region: United States

HSCC Medical Device and Health IT Joint Security Plan v2.0 (March 2024)

A voluntary secure-product-development framework written by the Healthcare and Public Health Sector Coordinating Council for the medical device and health IT sector, published March 2024.

Region: Global (applies anywhere)

Canadian Cyber Essentials 2024

Baseline cyber security for Canadian small and medium organizations

Region: Canada

Australian Essential Eight 2024

Australian Signals Directorate (ASD) Essential Eight Maturity Model — eight prioritized mitigation strategies to protect internet-connected IT networks against cyber threats.

Region: Australia

Ontario Personal Health Information Protection Act (PHIPA) 2004, as amended

Ontario's health privacy statute, the Personal Health Information Protection Act, 2004.

Region: Ontario, Canada

Privacy

CCPA / CPRA 2023

California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Region: California, United States

Alberta PIPA 2022

Alberta Personal Information Protection Act (PIPA).

Region: Alberta, Canada

BC PIPA 2023

British Columbia Personal Information Protection Act (PIPA).

Region: British Columbia, Canada

Quebec Law 25 (Private Sector Privacy) 2024

Quebec Act respecting the protection of personal information in the private sector, as amended by Bill 64 (Law 25).

Region: Quebec, Canada

BC FIPPA 2023

British Columbia Freedom of Information and Protection of Privacy Act (FIPPA/FOIPPA).

Region: British Columbia, Canada

EU GDPR 2018

General Data Protection Regulation (EU) 2016/679 — the world's strongest data privacy law.

Region: European Union

UK GDPR / Data Protection Act 2018 2021

UK General Data Protection Regulation (retained EU law post-Brexit) together with the Data Protection Act 2018.

Region: United Kingdom

Australian Privacy Act 1988 2024

Australian Privacy Act 1988 including the Australian Privacy Principles (APPs).

Region: Australia

PIPEDA 2024

Personal Information Protection and Electronic Documents Act — Canada's federal private-sector privacy law.

Region: Canada

Children's Online Privacy Protection Rule (COPPA) 16 CFR 312, amended 2025

Children's Online Privacy Protection Rule (COPPA Rule), 16 CFR Part 312, enforced by the US Federal Trade Commission.

Region: United States

Consumer Privacy Protection Act (CPPA) - Draft, not in force Bill C-27 first reading (died 6 January 2025)

DRAFT, NOT IN FORCE, AND SUPERSEDED FOR PLANNING.

Region: Canada

Protecting Privacy and Consumer Data Act (PPCDA) - Draft, Bill C-36, not in force Bill C-36 first reading (15 June 2026)

PROPOSED LAW, NOT IN FORCE.

Region: Canada

Payment card

PCI DSS SAQ A v4.0.1

For card-not-present merchants (e-commerce, mail/telephone order) that have fully outsourced all cardholder data functions to PCI DSS compliant third-party service providers.

Region: Global (applies anywhere)

PCI DSS SAQ A-EP v4.0.1

For e-commerce merchants with a website that redirects to a third-party payment processor.

Region: Global (applies anywhere)

PCI DSS SAQ B v4.0.1

For merchants using only imprint machines or standalone dial-out terminals (no electronic cardholder data storage).

Region: Global (applies anywhere)

PCI DSS SAQ B-IP v4.0.1

For merchants using only standalone, PCI PTS-approved point-of-interaction (POI) terminals with an IP connection to the payment processor.

Region: Global (applies anywhere)

PCI DSS SAQ C v4.0.1

For merchants with payment application systems (e.

Region: Global (applies anywhere)

PCI DSS SAQ C-VT v4.0.1

For merchants manually entering a single transaction at a time via a web-based virtual terminal provided by a PCI DSS compliant third-party service provider.

Region: Global (applies anywhere)

PCI DSS SAQ D v4.0.1

Full PCI DSS assessment for merchants and service providers that do not meet the criteria for any other SAQ type.

Region: Global (applies anywhere)

Energy & critical infrastructure

NERC CIP 7

North American Electric Reliability Corporation Critical Infrastructure Protection standards for the bulk electric system.

Region: North America

Critical Cyber Systems Protection Act (Bill C-8) 2026

Canada's critical cyber systems law.

Region: Canada

Canadian Oil & Gas / Energy Cyber Security 2026

The cyber and physical security expectations that fall on Canadian oil, gas, and pipeline operators.

Region: Canada

US Pipeline & Energy Cyber Security (TSA) 2026

Cyber security requirements for US pipeline and energy operators.

Region: United States

Government & public sector

Criminal justice

FBI CJIS Security Policy 6.1

The security requirements attached to criminal justice information.

Region: United States

FBI CJIS Security Policy 5.9.5 (Pre-Modernization) 5.9.5

The last release of the pre-modernization CJIS Security Policy, published July 9, 2024, organized as thirteen numbered policy areas rather than NIST control families.

Region: United States

Privacy, records & disclosure

Alberta Protection of Privacy Act (POPA) / Access to Information Act (AITA) 2025

Alberta's public sector privacy and access law.

Region: Alberta, Canada

Ontario MFIPPA - Municipal Freedom of Information and Protection of Privacy Act (as amended by Bill 194) 2024 amendments

The Municipal Freedom of Information and Protection of Privacy Act, as amended by Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024.

Region: Ontario, Canada

Iowa Public Sector Information Obligations 2026

What Iowa law asks of a city, county, or other governmental subdivision holding personal information and public records.

Region: Iowa, United States

IRS Publication 1075 - Federal Tax Information 2024

The safeguards an organization must have in place to receive Federal Tax Information from the IRS.

Region: United States

Accessibility

ADA Title II - Web and Mobile Accessibility 2024 Final Rule

The Department of Justice rule requiring the web content and mobile applications of state and local governments to conform to WCAG 2.

Region: United States

Ontario AODA - Integrated Accessibility Standards (O. Reg. 191/11) O. Reg. 191/11, consolidated 30 March 2026

Ontario's accessibility standards for every organization with at least one employee in Ontario, with obligations that scale with size.

Region: Ontario, Canada

WCAG 2.0 - Web Content Accessibility Guidelines 2.0 W3C Recommendation, 11 December 2008

The 2008 W3C accessibility standard that Ontario's AODA requires at Level AA for large and public sector websites.

Region: Global (applies anywhere)

WCAG 2.2 - Web Content Accessibility Guidelines 2.2 W3C Recommendation, 12 December 2024 (first publis

The current W3C web accessibility standard, and the version W3C recommends you meet now.

Region: Global (applies anywhere)

WCAG 3.0 Working Draft (10 September 2026) - DRAFT, not a standard W3C Working Draft, 10 September 2026 (draft)

A W3C Working Draft, not a standard. Measure readiness against its draft requirements; no one can claim conformance to it yet.

Region: Global (applies anywhere)

Baselines & cloud assurance

NIST SP 800-53 - Security and Privacy Controls Rev. 5

The catalogue that most other North American frameworks are derived from.

Region: Global (applies anywhere)

GovRAMP (formerly StateRAMP) - Cloud Vendor Assurance 2026

Standardized security assurance for cloud products sold to state, local, territorial, tribal, and education organizations.

Region: United States

CCCS Cloud Control Profiles (ITSP.50.103) ITSP.50.103 Annexes A and B

Canadian Centre for Cyber Security cloud security control profiles, from ITSP.

Region: Canada

CCCS Cloud Assessment: Medium and PBHVA Program page June 2026; ITSM.50.100

Cyber Centre Cloud Service Provider IT Security Assessment Program, at the Cloud Medium (formerly PBMM) and Protected B High Value Assets (PBHVA) levels.

Region: Canada

CCCS Common Criteria Program (Product Certification) Program Instructions v2.3 (May 2025)

Canadian Common Criteria Program, run by the Canadian Centre for Cyber Security as Canada's Certification Body under the Common Criteria Recognition Arrangement (CCRA).

Region: Canada

Critical public services

US Water & Wastewater Cyber Security (AWIA) 2026

Cyber and physical security requirements for community water systems, which in most of the United States means the municipality.

Region: United States

Healthcare

HITRUST CSF 11

HITRUST Common Security Framework (CSF) v11 — a certifiable framework that provides organizations with a comprehensive, flexible, and efficient approach to regulatory/standards compliance and risk…

Region: Global (applies anywhere)

HIPAA Security Rule 2024

The HIPAA Security Rule establishes national standards to protect individuals' electronic personal health information.

Region: United States

BC E-Health Act 2024

British Columbia E-Health (Personal Health Information Access and Protection of Privacy) Act.

Region: British Columbia, Canada

Alberta Health Information Act 2024

Alberta Health Information Act (HIA) requirements for custodians of health information.

Region: Alberta, Canada

FDA Cybersecurity for Cyber Devices (Section 524B) 2026 guidance

Mandatory cybersecurity content for US premarket submissions.

Region: United States

Health Canada Medical Device Cybersecurity June 2019 guidance

Health Canada's pre-market cybersecurity expectations for medical devices, from the Guidance Document "Pre-market Requirements for Medical Device Cybersecurity", finalized June 2019.

Region: Canada

AI governance

NIST AI Risk Management Framework 1.0 + GenAI Profile (NIST-AI-600-1)

Voluntary, vendor-neutral framework for governing, mapping, measuring, and managing risks of AI systems across their lifecycle.

Region: Global (applies anywhere)

ISO/IEC 42001 - AI Management System (AIMS) 2023

The certifiable international standard for an Artificial Intelligence Management System - the AI equivalent of ISO 27001.

Region: Global (applies anywhere)

EU Artificial Intelligence Act - Readiness Reg. (EU) 2024/1689

Readiness framework for the EU AI Act.

Region: European Union

OWASP Top 10 for LLM Applications 2025

Technical security controls for applications that integrate large language models: prompt injection, sensitive information disclosure, supply chain, data/model poisoning, improper output handling,…

Region: Global (applies anywhere)

Canada AI Governance Readiness 2026

Canadian AI governance readiness based on the federal Directive on Automated Decision-Making (in force; mandatory for federal automated decision systems and a strong voluntary baseline for the…

Region: Canada

Financial services

FTC Safeguards Rule 2023

FTC Standards for Safeguarding Customer Information (16 CFR 314), revised 2023.

Region: United States

GLBA: Gramm-Leach-Bliley Act 2023

Gramm-Leach-Bliley Act (GLBA) financial privacy and safeguards requirements for US financial institutions.

Region: United States

NYDFS Cybersecurity Regulation 2023

New York Department of Financial Services Cybersecurity Regulation (23 NYCRR 500), amended 2023.

Region: New York, United States

FINTRAC / PCMLTFA 2024

Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) requirements under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA).

Region: Canada

EU DORA 2025

Digital Operational Resilience Act — Regulation (EU) 2022/2554, effective 17 January 2025.

Region: European Union

BC Financial Services Authority Security Guidance 2024

British Columbia Financial Services Authority cybersecurity and technology risk management guidance.

Region: British Columbia, Canada

CPA Canada Cybersecurity Framework 2024

CPA Canada guidance on cybersecurity risk management and reporting.

Region: Canada

CIRO Cybersecurity Program - Dealer Members 2026

The cybersecurity obligations and expectations CIRO (the Canadian Investment Regulatory Organization) places on its Dealer Members.

Region: Canada

CSA Staff Notice 33-322 - Registered Firm Cybersecurity 15 July 2026

The Canadian Securities Administrators' current cybersecurity expectations for registered firms, published 15 July 2026 after a review of 73 firms.

Region: Canada

See how Lavawall GRC works