Compliance frameworks Lavawall® supports

Lavawall maps, assesses, and keeps evidence current for the frameworks below. Open yours for the requirements, the assessment tiers, and how Lavawall automates the technical controls.

Security & governance

CIS Controls v8 8.1

Center for Internet Security Critical Security Controls Version 8.

Canadian Program for Cyber Security Certification (CPCSC) 1.0

The CPCSC is Canada's official cyber security certification program for defence and government suppliers, managed by Public Services and Procurement Canada (PSPC).

NIST Cybersecurity Framework (NIST CSF) 2.0

The NIST Cybersecurity Framework provides a policy framework of computer security guidance for how organizations can assess and improve their ability to prevent, detect, and respond to cyber attacks.

NIST SP 800-171 r3

Protecting Controlled Unclassified Information in Nonfederal Systems

Canadian Centre for Cyber Security Guidance 2024

Baseline Cyber Security Controls for Small and Medium Organizations from the Canadian Centre for Cyber Security.

COBIT 2019 2019

ISACA COBIT 2019 framework for governance and management of enterprise information and technology.

ITIL 4 4

ITIL 4 framework for IT service management.

Ontario Cyber Security Framework 2024

Ontario government cybersecurity framework for public sector organizations.

ISO/IEC 27001 2022

ISO/IEC 27001 is an international standard for information security management systems (ISMS).

Sarbanes-Oxley Act (SOX) 2002

Sarbanes-Oxley Act of 2002 — US federal law requiring publicly traded companies to maintain internal controls over financial reporting (ICFR).

C-SOX (Canadian Securities NI 52-109) 2023

Canadian equivalent of Sarbanes-Oxley, implemented through National Instrument 52-109 — Certification of Disclosure in Issuers Annual and Interim Filings.

EU NIS2 Directive 2024

Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union.

CMMC v2.0

Cybersecurity Maturity Model Certification - Required for DoD contractors handling CUI/FCI.

UK Cyber Essentials 2025

UK government-backed Cyber Essentials certification scheme (Willow update, effective April 2025).

EU Cyber Resilience Act (CRA) 2024

Regulation (EU) 2024/2847 — Cyber Resilience Act, entered into force 10 December 2024.

SOC 2 2024

SOC 2 Trust Services Criteria — Type I (point-in-time design assessment) and Type II (operating effectiveness over a period, typically 6-12 months).

IEC 81001-5-1 Health Software Security Life Cycle 2021

The standard that defines what a secure development life cycle looks like for health software and health IT, published 2021.

ANSI/AAMI SW96 Medical Device Security Risk Management 2023

The American National Standard for security risk management of medical devices, published November 2023, together with AAMI TIR57:2016/(R)2023, the technical information report it builds on.

HSCC Medical Device and Health IT Joint Security Plan v2.0 (March 2024)

A voluntary secure-product-development framework written by the Healthcare and Public Health Sector Coordinating Council for the medical device and health IT sector, published March 2024.

Canadian Cyber Essentials 2024

Baseline cyber security for Canadian small and medium organizations

Australian Essential Eight 2024

Australian Signals Directorate (ASD) Essential Eight Maturity Model — eight prioritized mitigation strategies to protect internet-connected IT networks against cyber threats.

Ontario Personal Health Information Protection Act (PHIPA) 2004, as amended

Ontario's health privacy statute, the Personal Health Information Protection Act, 2004.

Privacy

CCPA / CPRA 2023

California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Alberta PIPA 2022

Alberta Personal Information Protection Act (PIPA).

BC PIPA 2023

British Columbia Personal Information Protection Act (PIPA).

Quebec Law 25 (Private Sector Privacy) 2024

Quebec Act respecting the protection of personal information in the private sector, as amended by Bill 64 (Law 25).

BC FIPPA 2023

British Columbia Freedom of Information and Protection of Privacy Act (FIPPA/FOIPPA).

EU GDPR 2018

General Data Protection Regulation (EU) 2016/679 — the world's strongest data privacy law.

UK GDPR / Data Protection Act 2018 2021

UK General Data Protection Regulation (retained EU law post-Brexit) together with the Data Protection Act 2018.

Australian Privacy Act 1988 2024

Australian Privacy Act 1988 including the Australian Privacy Principles (APPs).

PIPEDA 2024

Personal Information Protection and Electronic Documents Act — Canada's federal private-sector privacy law.

Payment card

PCI DSS SAQ A v4.0.1

For card-not-present merchants (e-commerce, mail/telephone order) that have fully outsourced all cardholder data functions to PCI DSS compliant third-party service providers.

PCI DSS SAQ A-EP v4.0.1

For e-commerce merchants with a website that redirects to a third-party payment processor.

PCI DSS SAQ B v4.0.1

For merchants using only imprint machines or standalone dial-out terminals (no electronic cardholder data storage).

PCI DSS SAQ B-IP v4.0.1

For merchants using only standalone, PCI PTS-approved point-of-interaction (POI) terminals with an IP connection to the payment processor.

PCI DSS SAQ C v4.0.1

For merchants with payment application systems (e.

PCI DSS SAQ C-VT v4.0.1

For merchants manually entering a single transaction at a time via a web-based virtual terminal provided by a PCI DSS compliant third-party service provider.

PCI DSS SAQ D v4.0.1

Full PCI DSS assessment for merchants and service providers that do not meet the criteria for any other SAQ type.

Energy & critical infrastructure

NERC CIP 7

North American Electric Reliability Corporation Critical Infrastructure Protection standards for the bulk electric system.

Critical Cyber Systems Protection Act (Bill C-8) 2026

Canada's critical cyber systems law.

Canadian Oil & Gas / Energy Cyber Security 2026

The cyber and physical security expectations that fall on Canadian oil, gas, and pipeline operators.

US Pipeline & Energy Cyber Security (TSA) 2026

Cyber security requirements for US pipeline and energy operators.

Government & public sector

Criminal justice

FBI CJIS Security Policy 6.1

The security requirements attached to criminal justice information.

FBI CJIS Security Policy 5.9.5 (Pre-Modernization) 5.9.5

The last release of the pre-modernization CJIS Security Policy, published July 9, 2024, organized as thirteen numbered policy areas rather than NIST control families.

Privacy, records & disclosure

Alberta Protection of Privacy Act (POPA) / Access to Information Act (AITA) 2025

Alberta's public sector privacy and access law.

Ontario MFIPPA - Municipal Freedom of Information and Protection of Privacy Act (as amended by Bill 194) 2024 amendments

The Municipal Freedom of Information and Protection of Privacy Act, as amended by Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024.

Iowa Public Sector Information Obligations 2026

What Iowa law asks of a city, county, or other governmental subdivision holding personal information and public records.

IRS Publication 1075 - Federal Tax Information 2024

The safeguards an organization must have in place to receive Federal Tax Information from the IRS.

Accessibility

ADA Title II - Web and Mobile Accessibility 2024 Final Rule

The Department of Justice rule requiring the web content and mobile applications of state and local governments to conform to WCAG 2.

Baselines & cloud assurance

NIST SP 800-53 - Security and Privacy Controls Rev. 5

The catalogue that most other North American frameworks are derived from.

GovRAMP (formerly StateRAMP) - Cloud Vendor Assurance 2026

Standardized security assurance for cloud products sold to state, local, territorial, tribal, and education organizations.

Critical public services

US Water & Wastewater Cyber Security (AWIA) 2026

Cyber and physical security requirements for community water systems, which in most of the United States means the municipality.

Healthcare

HITRUST CSF 11

HITRUST Common Security Framework (CSF) v11 — a certifiable framework that provides organizations with a comprehensive, flexible, and efficient approach to regulatory/standards compliance and risk…

HIPAA Security Rule 2024

The HIPAA Security Rule establishes national standards to protect individuals' electronic personal health information.

BC E-Health Act 2024

British Columbia E-Health (Personal Health Information Access and Protection of Privacy) Act.

Alberta Health Information Act 2024

Alberta Health Information Act (HIA) requirements for custodians of health information.

FDA Cybersecurity for Cyber Devices (Section 524B) 2026 guidance

Mandatory cybersecurity content for US premarket submissions.

Health Canada Medical Device Cybersecurity June 2019 guidance

Health Canada's pre-market cybersecurity expectations for medical devices, from the Guidance Document "Pre-market Requirements for Medical Device Cybersecurity", finalized June 2019.

AI governance

NIST AI Risk Management Framework 1.0 + GenAI Profile (NIST-AI-600-1)

Voluntary, vendor-neutral framework for governing, mapping, measuring, and managing risks of AI systems across their lifecycle.

ISO/IEC 42001 - AI Management System (AIMS) 2023

The certifiable international standard for an Artificial Intelligence Management System - the AI equivalent of ISO 27001.

EU Artificial Intelligence Act - Readiness Reg. (EU) 2024/1689

Readiness framework for the EU AI Act.

OWASP Top 10 for LLM Applications 2025

Technical security controls for applications that integrate large language models: prompt injection, sensitive information disclosure, supply chain, data/model poisoning, improper output handling,…

Canada AI Governance Readiness 2026

Canadian AI governance readiness based on the federal Directive on Automated Decision-Making (in force; mandatory for federal automated decision systems and a strong voluntary baseline for the…

Financial services

FTC Safeguards Rule 2023

FTC Standards for Safeguarding Customer Information (16 CFR 314), revised 2023.

GLBA — Gramm-Leach-Bliley Act 2023

Gramm-Leach-Bliley Act (GLBA) financial privacy and safeguards requirements for US financial institutions.

NYDFS Cybersecurity Regulation 2023

New York Department of Financial Services Cybersecurity Regulation (23 NYCRR 500), amended 2023.

FINTRAC / PCMLTFA 2024

Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) requirements under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA).

EU DORA 2025

Digital Operational Resilience Act — Regulation (EU) 2022/2554, effective 17 January 2025.

BC Financial Services Authority Security Guidance 2024

British Columbia Financial Services Authority cybersecurity and technology risk management guidance.

CPA Canada Cybersecurity Framework 2024

CPA Canada guidance on cybersecurity risk management and reporting.

CIRO Cybersecurity Program - Dealer Members 2026

The cybersecurity obligations and expectations CIRO (the Canadian Investment Regulatory Organization) places on its Dealer Members.

CSA Staff Notice 33-322 - Registered Firm Cybersecurity 15 July 2026

The Canadian Securities Administrators' current cybersecurity expectations for registered firms, published 15 July 2026 after a review of 73 firms.

See how Lavawall GRC works