OMNI-GRC

Compliance Frameworks Reference

OMNI-GRC supports 36+ compliance frameworks across all major industries. This document provides detailed information about each framework, its controls, and implementation guidance.

Overview
Core Frameworks
Healthcare Frameworks
Financial Services Frameworks
Government Frameworks
Privacy Frameworks
Cloud Security Frameworks
Emerging Technology Frameworks
Critical Infrastructure Frameworks
Cross-Framework Mapping

Overview

OMNI-GRC’s framework library is organized by industry with cross-framework control mappings. Our “Scan Once, Comply Everywhere” approach means a single security assessment maps to multiple frameworks simultaneously.

Framework Statistics

Metric	Count
Total Frameworks	36
Total Controls	4,108
Best Practices	55
Industry Checklists	15
Industries Covered	12

Industry Coverage

Industry	Frameworks	Description
🏥 Healthcare	3	HIPAA, HITRUST, FDA regulations
🏦 Financial Services	6	PCI-DSS, SOX, GLBA, Basel, MAS TRM, FFIEC
🏛️ Government	7	FedRAMP, CMMC, FISMA, NIST 800-53/171, ITAR, StateRAMP
🔐 Privacy	6	GDPR, CCPA, LGPD, PDPA, PIPEDA, APPI
☁️ Cloud Security	3	CSA CCM, ISO 27017, ISO 27018
🤖 Emerging Tech	3	NIST AI RMF, EU AI Act, ISO 42001
⚡ Critical Infrastructure	3	NERC CIP, IEC 62443, TSA SD
💻 Technology	5	SOC 2, ISO 27001, NIST CSF, CIS Controls, COBIT

Core Frameworks

These frameworks have full control definitions with scanner mappings in OMNI-GRC.

SOC 2 Type II

Attribute	Value
Version	2017
Controls	64
Region	Global
Mandatory	No (but industry standard for SaaS)

Description: Service Organization Control 2 - Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy. The gold standard for SaaS companies.

Trust Service Criteria:

CC (Common Criteria) - Security controls
A (Availability) - System availability commitments
PI (Processing Integrity) - Accurate, complete processing
C (Confidentiality) - Data confidentiality
P (Privacy) - Personal information handling

ISO 27001:2022

Attribute	Value
Version	2022
Controls	93
Region	Global
Mandatory	No

Description: International standard for information security management systems (ISMS). Globally recognized framework for establishing, implementing, and maintaining security controls.

Control Categories (Annex A):

A.5 - Organizational controls (37 controls)
A.6 - People controls (8 controls)
A.7 - Physical controls (14 controls)
A.8 - Technological controls (34 controls)

NIST CSF 2.0

Attribute	Value
Version	2.0
Controls	106
Region	United States
Mandatory	No (voluntary for most)

Description: NIST Cybersecurity Framework - A framework for improving critical infrastructure cybersecurity with 6 core functions.

Core Functions:

Govern (GV) - Organizational context and risk management strategy
Identify (ID) - Asset management, risk assessment
Protect (PR) - Access control, training, data security
Detect (DE) - Monitoring and anomaly detection
Respond (RS) - Incident response and mitigation
Recover (RC) - Recovery planning and improvements

HIPAA

Attribute	Value
Version	2013
Controls	54
Region	United States
Mandatory	Yes (for covered entities)

Description: Health Insurance Portability and Accountability Act - Security and Privacy Rules for protecting patient health information (PHI).

Key Rules:

Security Rule (45 CFR Part 164, Subpart C) - Technical/physical safeguards
Privacy Rule (45 CFR Part 164, Subpart E) - PHI use and disclosure
Breach Notification Rule - Breach reporting requirements

PCI-DSS v4.0

Attribute	Value
Version	4.0
Controls	78
Region	Global
Mandatory	Yes (for payment card handling)

Description: Payment Card Industry Data Security Standard - Security requirements for organizations handling credit card transactions.

Requirements:

Install and maintain network security controls
Apply secure configurations to all system components
Protect stored account data
Protect cardholder data with strong cryptography
Protect all systems and networks from malicious software
Develop and maintain secure systems and software

Attribute	Value
Version	2018
Controls	48
Region	European Union
Mandatory	Yes (for EU data)

Description: General Data Protection Regulation - EU regulation on data protection and privacy.

Key Principles:

Lawfulness, fairness, transparency
Purpose limitation
Data minimization
Accuracy
Storage limitation
Integrity and confidentiality
Accountability

FedRAMP High

Attribute	Value
Version	Rev 5
Controls	421
Region	United States
Mandatory	Yes (for federal cloud)

Description: Federal Risk and Authorization Management Program - US government cloud security framework.

Impact Levels:

Low - 125 controls
Moderate - 325 controls
High - 421 controls

CMMC 2.0 Level 2

Attribute	Value
Version	2.0
Controls	110
Region	United States
Mandatory	Yes (for DoD contractors)

Description: Cybersecurity Maturity Model Certification - DoD cybersecurity requirements for defense contractors.

Maturity Levels:

Level 1 - Foundational (17 practices)
Level 2 - Advanced (110 practices, NIST 800-171)
Level 3 - Expert (110+ practices)

Healthcare Frameworks

HITRUST CSF v11

Attribute	Value
Version	v11
Controls	156
Region	United States
Mandatory	No (industry best practice)

Description: Health Information Trust Alliance Common Security Framework - Comprehensive framework harmonizing healthcare regulations and security standards.

Key Features:

Incorporates HIPAA, NIST, ISO 27001, PCI-DSS requirements
Risk-based approach with multiple assessment levels
Certification program (r2, i1, e1)

FDA 21 CFR Part 11

Attribute	Value
Version	2003
Controls	32
Region	United States
Mandatory	Yes (for regulated industries)

Description: FDA regulations on electronic records and electronic signatures for pharmaceutical and medical device companies.

Key Requirements:

Electronic signature controls
Audit trail requirements
System validation
Record retention

Financial Services Frameworks

SOX (Sarbanes-Oxley)

Attribute	Value
Version	2002
Controls	45
Region	United States
Mandatory	Yes (public companies)

Description: Sarbanes-Oxley Act - US law requiring internal control assessments for financial reporting in publicly traded companies.

Key Sections:

Section 302 - CEO/CFO certification
Section 404 - Internal control assessment
Section 409 - Real-time issuer disclosures

GLBA (Gramm-Leach-Bliley)

Attribute	Value
Version	1999
Controls	28
Region	United States
Mandatory	Yes (financial institutions)

Description: Gramm-Leach-Bliley Act - US law requiring financial institutions to protect customer financial information.

Basel III/IV

Attribute	Value
Version	IV (2023)
Controls	35
Region	Global
Mandatory	Yes (banks)

Description: International regulatory framework for banks, including operational risk and IT controls requirements.

MAS TRM

Attribute	Value
Version	2021
Controls	52
Region	Singapore
Mandatory	Yes (Singapore FIs)

Description: Monetary Authority of Singapore Technology Risk Management Guidelines for financial institutions.

FFIEC IT Examination

Attribute	Value
Version	2024
Controls	68
Region	United States
Mandatory	Yes (US FIs)

Description: Federal Financial Institutions Examination Council IT Examination Handbook for US financial institutions.

Government Frameworks

FISMA

Attribute	Value
Version	2014
Controls	85
Region	United States
Mandatory	Yes (federal agencies)

Description: Federal Information Security Management Act - US law requiring federal agencies to develop security programs.

NIST SP 800-53 Rev 5

Attribute	Value
Version	Rev 5
Controls	1,189
Region	United States
Mandatory	Yes (federal systems)

Description: Security and Privacy Controls for Information Systems and Organizations - Comprehensive control catalog for federal systems.

Control Families:

AC (Access Control) - 25 controls
AU (Audit and Accountability) - 16 controls
AT (Awareness and Training) - 6 controls
CM (Configuration Management) - 14 controls
CP (Contingency Planning) - 13 controls
IA (Identification and Authentication) - 12 controls
IR (Incident Response) - 10 controls
MA (Maintenance) - 7 controls
MP (Media Protection) - 8 controls
PE (Physical and Environmental) - 23 controls
PL (Planning) - 11 controls
PS (Personnel Security) - 9 controls
RA (Risk Assessment) - 10 controls
SA (System and Services Acquisition) - 23 controls
SC (System and Communications Protection) - 51 controls
SI (System and Information Integrity) - 23 controls

NIST SP 800-171 Rev 2

Attribute	Value
Version	Rev 2
Controls	110
Region	United States
Mandatory	Yes (DoD contractors)

Description: Protecting Controlled Unclassified Information (CUI) in Nonfederal Systems - Required for DoD contractors.

ITAR

Attribute	Value
Version	2023
Controls	24
Region	United States
Mandatory	Yes (defense exporters)

Description: International Traffic in Arms Regulations - US regulations controlling export of defense articles and services.

StateRAMP

Attribute	Value
Version	2023
Controls	325
Region	United States
Mandatory	Varies by state

Description: State Risk and Authorization Management Program - Security authorization for state and local governments.

Privacy Frameworks

CCPA/CPRA

Attribute	Value
Version	2023
Controls	35
Region	California, USA
Mandatory	Yes (qualifying businesses)

Description: California Consumer Privacy Act / California Privacy Rights Act - California state privacy law.

LGPD

Attribute	Value
Version	2020
Controls	28
Region	Brazil
Mandatory	Yes (Brazilian data)

Description: Lei Geral de Proteção de Dados - Brazil’s General Data Protection Law.

PDPA

Attribute	Value
Version	2020
Controls	22
Region	Singapore
Mandatory	Yes (Singapore data)

Description: Personal Data Protection Act - Singapore’s data protection law.

PIPEDA

Attribute	Value
Version	2019
Controls	20
Region	Canada
Mandatory	Yes (Canadian data)

Description: Personal Information Protection and Electronic Documents Act - Canada’s federal privacy law.

APPI

Attribute	Value
Version	2022
Controls	18
Region	Japan
Mandatory	Yes (Japanese data)

Description: Act on the Protection of Personal Information - Japan’s data protection law.

Cloud Security Frameworks

CSA CCM v4

Attribute	Value
Version	4.0
Controls	197
Region	Global
Mandatory	No

Description: Cloud Security Alliance Cloud Controls Matrix - A cybersecurity control framework for cloud computing.

Control Domains:

Application & Interface Security (AIS)
Audit Assurance & Compliance (AAC)
Business Continuity Management (BCM)
Change Control & Configuration Management (CCC)
Data Security & Privacy (DSP)
Datacenter Security (DCS)
Encryption & Key Management (EKM)
Governance, Risk & Compliance (GRC)
Human Resources (HRS)
Identity & Access Management (IAM)
Infrastructure & Virtualization (IVS)
Interoperability & Portability (IPY)
Logging & Monitoring (LOG)
Security Incident Management (SIM)
Supply Chain Management (STA)
Threat & Vulnerability Management (TVM)
Universal Endpoint Management (UEM)

ISO 27017

Attribute	Value
Version	2015
Controls	37
Region	Global
Mandatory	No

Description: Code of practice for information security controls based on ISO/IEC 27002 for cloud services.

ISO 27018

Attribute	Value
Version	2019
Controls	25
Region	Global
Mandatory	No

Description: Code of practice for protection of personally identifiable information (PII) in public clouds.

Emerging Technology Frameworks

NIST AI RMF 1.0

Attribute	Value
Version	1.0
Controls	72
Region	United States
Mandatory	No

Description: NIST Artificial Intelligence Risk Management Framework - Framework for managing risks of AI systems.

Core Functions:

Govern - Organizational AI governance
Map - Context and risk identification
Measure - Risk assessment and analysis
Manage - Risk treatment and monitoring

EU AI Act

Attribute	Value
Version	2024
Controls	85
Region	European Union
Mandatory	Yes (for EU market)

Description: European Union Artificial Intelligence Act - First comprehensive legal framework for AI.

Risk Categories:

Unacceptable Risk - Prohibited AI systems
High Risk - Strict requirements
Limited Risk - Transparency obligations
Minimal Risk - Voluntary codes

ISO/IEC 42001

Attribute	Value
Version	2023
Controls	38
Region	Global
Mandatory	No

Description: Artificial Intelligence Management System (AIMS) - First international AI management system standard.

Critical Infrastructure Frameworks

NERC CIP

Attribute	Value
Version	v7
Controls	45
Region	North America
Mandatory	Yes (bulk power)

Description: North American Electric Reliability Corporation Critical Infrastructure Protection standards.

IEC 62443

Attribute	Value
Version	2022
Controls	128
Region	Global
Mandatory	Varies

Description: Industrial Automation and Control Systems Security - International standards for OT/ICS security.

TSA Security Directives

Attribute	Value
Version	2023
Controls	42
Region	United States
Mandatory	Yes (pipeline/transportation)

Description: Transportation Security Administration Security Directives for pipeline and transportation operators.

Cross-Framework Mapping

OMNI-GRC provides automated mapping between frameworks. Here are some key mappings:

Access Control Mapping

Control Area	SOC 2	ISO 27001	HIPAA	PCI-DSS	NIST CSF
User Authentication	CC6.1	A.5.16	164.312(d)	8.3	PR.AC-1
Multi-Factor Auth	CC6.1	A.8.5	164.312(d)	8.4	PR.AC-7
Access Reviews	CC6.2	A.5.18	164.308(a)(4)	7.2	PR.AC-1
Least Privilege	CC6.1	A.8.2	164.312(a)(1)	7.1	PR.AC-4

Data Protection Mapping

Control Area	SOC 2	ISO 27001	HIPAA	PCI-DSS	GDPR
Encryption at Rest	CC6.7	A.8.24	164.312(a)(2)(iv)	3.4	Art.32
Encryption in Transit	CC6.7	A.8.24	164.312(e)(1)	4.1	Art.32
Data Classification	CC6.7	A.5.12	164.312(a)(1)	9.6	Art.30
Data Retention	CC6.5	A.5.33	164.530(j)	3.1	Art.5(1)(e)

Using Frameworks in OMNI-GRC

Enable Frameworks

Go to Settings → General
Select frameworks under Enabled Compliance Frameworks
Click Save Changes

View Framework Status

Navigate to Compliance
Use industry filter to narrow down frameworks
Click on a framework to see control status

Generate Framework Reports

Go to Reports
Select Framework Assessment template
Choose frameworks to include
Generate PDF, CSV, or Google Docs

Resources

Last Updated: January 2026
Applies to: OMNI-GRC v0.1.0+