Compliance frameworks Lavawall® supports

Lavawall maps, assesses, and keeps evidence current for the frameworks below. Search or pick a region, then open yours for the requirements, the assessment tiers, and how Lavawall automates the technical controls.

Security & governance

CIS Controls v8 8.1

Center for Internet Security Critical Security Controls Version 8.

Global (applies anywhere)

Canadian Program for Cyber Security Certification (CPCSC) ITSP.10.171 Oct 2025; Level 1 Apr 2026

Canadian Program for Cyber Security Certification, run by Public Services and Procurement Canada for defence suppliers.

Canada

NIST Cybersecurity Framework (NIST CSF) 2.0

The NIST Cybersecurity Framework provides a policy framework of computer security guidance for how organizations can assess and improve their ability to prevent, detect, and respond to cyber attacks.

Global (applies anywhere)

NIST SP 800-171 r3

Protecting Controlled Unclassified Information in Nonfederal Systems

United States

Canadian Centre for Cyber Security Guidance 2024

Baseline Cyber Security Controls for Small and Medium Organizations from the Canadian Centre for Cyber Security.

Canada

COBIT 2019 2019

ISACA COBIT 2019 framework for governance and management of enterprise information and technology.

Global (applies anywhere)

ITIL 4 4

ITIL 4 framework for IT service management.

Global (applies anywhere)

Ontario Cyber Security Framework 2024

Ontario government cybersecurity framework for public sector organizations.

Ontario, Canada

ISO/IEC 27001 2022

ISO/IEC 27001 is an international standard for information security management systems (ISMS).

Global (applies anywhere)

Sarbanes-Oxley Act (SOX) 2002

Sarbanes-Oxley Act of 2002 — US federal law requiring publicly traded companies to maintain internal controls over financial reporting (ICFR).

United States

C-SOX (Canadian Securities NI 52-109) 2023

Canadian equivalent of Sarbanes-Oxley, implemented through National Instrument 52-109 — Certification of Disclosure in Issuers Annual and Interim Filings.

Canada

EU NIS2 Directive 2024

Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union.

European Union

CMMC v2.0

Cybersecurity Maturity Model Certification - Required for DoD contractors handling CUI/FCI.

United States

UK Cyber Essentials 2025

UK government-backed Cyber Essentials certification scheme (Willow update, effective April 2025).

United Kingdom

EU Cyber Resilience Act (CRA) 2024

Regulation (EU) 2024/2847 — Cyber Resilience Act, entered into force 10 December 2024.

European Union

SOC 2 2024

SOC 2 Trust Services Criteria — Type I (point-in-time design assessment) and Type II (operating effectiveness over a period, typically 6-12 months).

Global (applies anywhere)

Canadian Cyber Essentials 2024

Baseline cyber security for Canadian small and medium organizations

Canada

Australian Essential Eight 2024

Australian Signals Directorate (ASD) Essential Eight Maturity Model — eight prioritized mitigation strategies to protect internet-connected IT networks against cyber threats.

Australia

Nova Scotia Personal Health Information Act (PHIA) S.N.S. 2010, c. 41; N.S. Reg. 217/2012

Nova Scotia Personal Health Information Act (PHIA), S.

Nova Scotia, Canada

Nova Scotia public sector privacy (FOIPOP, PIIDPA and the 2027 Act) 1993 Act, PIIDPA; 2025 c. 13 from 1 Apr 2027

Nova Scotia public sector privacy, across the change of law on 1 April 2027.

Nova Scotia, Canada

New York State privacy and security rules (sector tiers) Sources read 23 Oct 2026; see description

No comprehensive New York consumer privacy statute was found enacted when this pack was written (23 October 2026).

New York, United States

New York SHIELD Act (GBL ss. 899-aa and 899-bb) GBL 899-aa (2025-03-28); 899-bb (2020-03-27)

The Stop Hacks and Improve Electronic Data Security (SHIELD) Act, Chapter 117 of the Laws of 2019, changed two parts of the General Business Law.

New York, United States

New Jersey state privacy and security law, by sector Statutes to P.L.2026, c.25; DOBI to Oct 2026

New Jersey state privacy and security law, organized by sector.

New Jersey, United States

New Jersey Data Privacy Act (NJDPA) P.L.2023, c.266 as amended to 30 June 2026

The New Jersey Data Privacy Act, P.

New Jersey, United States

Illinois state privacy and security law (sector tiers) Illinois law as read 23 Oct 2026

Illinois privacy, security and records law that goes beyond the federal and other state frameworks already in the library, arranged in sector tiers.

Illinois, United States

Illinois Biometric Information Privacy Act (BIPA) 740 ILCS 14; P.A. 103-769 (eff. 2 Aug 2024)

Illinois Biometric Information Privacy Act, 740 ILCS 14, assessed in the Act’s own order.

Illinois, United States

California state privacy and sector law (CalOPPA, breach, CMIA, DMV) Read 23 Oct 2026; see source list

California state law that applies alongside the CCPA and the federal sector rules, organized by tier so an organization picks only the sectors it works in.

California, United States

CPPA regulations: cybersecurity audits, risk assessments, ADMT 11 CCR Div. 6 Ch. 1, eff. 1 Jan 2026

The California Privacy Protection Agency regulations (Title 11 CCR, Division 6, Chapter 1) that add three programs to the California Consumer Privacy Act: independent cybersecurity audits, risk…

California, United States

Texas state requirements by sector (privacy, health, public) Statutes read 23 Oct 2026

Texas state requirements by sector, in one framework with seven tiers.

Texas, United States

Texas Data Privacy and Security Act (TDPSA) B&C Code ch. 541, in force 1 July 2024

Texas Data Privacy and Security Act (TDPSA), Business & Commerce Code ch.

Texas, United States

Texas Responsible Artificial Intelligence Governance Act (TRAIGA) B&C Code ch. 551-554, 1 Jan 2026

Texas Responsible Artificial Intelligence Governance Act (TRAIGA), HB 149, Business & Commerce Code Subtitle D (chs.

Texas, United States

Canada: Treasury Board Directive on Automated Decision-Making and AI guidance Directive amended 24 Jun 2025; Guide modified 24 Sep 2026

In force for federal institutions, not for private companies.

Canada

Ontario public sector AI rules (EDSTA and the OPS AI Directive) EDSTA Sch. 1 ss. 1 to 16 in force 29 Jan 2025; Directive 1 Dec 2024

Two instruments.

Ontario, Canada

Canadian provincial AI, deepfake and intimate image rules (tiers by province) Read 24 Oct 2026; several items not in force (see description)

One framework, one tier per jurisdiction, so a company picks the places it operates.

Canada

OSFI Guideline E-23: Model Risk Management (including AI and machine learning) OSFI page dated 11 Sep 2025; effective 1 May 2027

A supervisory guideline of the Office of the Superintendent of Financial Institutions, not a statute.

Canada

Safe Social Media Act (Digital Safety Act) - Draft, Bill C-34, not in force Bill C-34, first reading 10 June 2026; second reading in the House (debate 21 Oct 2026)

PROPOSED LAW, NOT IN FORCE.

Canada

TAKE IT DOWN Act (Pub. L. 119-12), platform notice and removal Pub. L. 119-12, 19 May 2025; section 3 duties from 19 May 2026

The Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act, Public Law 119-12, was approved on 19 May 2025.

United States

US state minors online safety laws (design codes, social media, app stores) State laws and court status read 24 Oct 2026; see description

A group of state laws that put duties on online services, app stores and device makers because of the age of the user.

United States

Family Educational Rights and Privacy Act (FERPA), 34 CFR Part 99 34 CFR Part 99, eCFR read 24 Oct 2026

FERPA (20 U.

United States

Children's Internet Protection Act (CIPA), E-rate certifications 47 U.S.C. 254(h), (l); 47 CFR 54.520, eCFR read 24 Oct 2026

CIPA (Public Law 106-554, Title XVII; 47 U.

United States

Accessible Canada Act and Regulations (federally regulated entities) Act and regs current to 30 Sep 2026

The Accessible Canada Act (S.

Canada

Manitoba Accessibility for Manitobans Act and standards C.C.S.M. c. A1.7, current 22 Oct 2026

The Accessibility for Manitobans Act (C.

Manitoba, Canada

Nova Scotia Accessibility Act and Built Environment Standard S.N.S. 2017, c. 2; standard from 1 Apr 2026

The Accessibility Act (S.

Nova Scotia, Canada

Accessible British Columbia Act and Regulation S.B.C. 2021, c. 19; B.C. Reg. 105/2022

The Accessible British Columbia Act (S.

British Columbia, Canada

Saskatchewan Accessible Saskatchewan Act and Regulations In force 3 Dec 2023; reports read 24 Oct 2026

The Accessible Saskatchewan Act and the Accessible Saskatchewan Regulations came into force on 3 December 2023 (Saskatchewan Accessibility Office annual reports for 2023-24 and 2024-25, read 24…

Saskatchewan, Canada

Newfoundland and Labrador Accessibility Act SNL 2021 c A-1.001; in force 3 Dec 2021

The Accessibility Act (SNL 2021, c.

Newfoundland and Labrador, Canada

Quebec Act to secure handicapped persons (annual accessibility action plans) CQLR c. E-20.1; Office guidance read 24 Oct 2026

Quebec's Act to secure handicapped persons in the exercise of their rights with a view to achieving social, school and workplace integration (CQLR, c.

Quebec, Canada

Colorado Automated Decision-Making Technology Act (SB 26-189, replacing SB 24-205) SB 26-189 signed 14 May 2026; effective 1 Jan 2027

Colorado replaced its first artificial intelligence statute before it took effect.

Colorado, United States

US state artificial intelligence laws (frontier, transparency, chatbots, employment, health care, government) Status as of 23 Oct 2026; see description

State artificial intelligence laws grouped by topic, so one assessment covers every state a business operates in, with a domain for each law.

United States

Alabama Personal Data Protection Act (PDPA) HB 351 (2026 Reg. Sess.), enrolled; effective 1 May 2027 (not yet in force)

The Alabama Personal Data Protection Act is HB 351 of the 2026 Regular Session, with an effective date of 1 May 2027, so it is not yet in force.

Alabama, United States

Colorado Privacy Act (CPA) C.R.S. 6-1-1301 to 6-1-1314; in force 1 July 2023

The Colorado Privacy Act is Part 13 of Article 1 of Title 6 of the Colorado Revised Statutes (SB21-190, signed 7 July 2021, in force 1 July 2023).

Colorado, United States

Connecticut Data Privacy Act (CTDPA) Conn. Gen. Stat. 42-515 et seq.; in force 1 July 2023; 2025 changes from 1 July 2026

The Connecticut Data Privacy Act (CTDPA) is Connecticut General Statutes sections 42-515 and following (Public Act 22-15, signed 10 May 2022, in force 1 July 2023).

Connecticut, United States

Delaware Personal Data Privacy Act (DPDPA) 6 Del. C. ch. 12D; in force 1 Jan 2025; amended text from 1 Jan 2027

The Delaware Personal Data Privacy Act is Title 6, Chapter 12D of the Delaware Code (84 Del.

Delaware, United States

Florida Digital Bill of Rights (FDBR) Fla. Stat. 501.701 to 501.722; in force 1 July 2024

The Florida Digital Bill of Rights is Part V of Chapter 501 of the Florida Statutes (ss.

Florida, United States

Iowa Consumer Data Protection Act (ICDPA) Iowa Code ch. 715D; in force 1 Jan 2025 (2023 Acts ch. 17)

The Iowa Consumer Data Protection Act is Iowa Code chapter 715D (2023 Acts ch.

Iowa, United States

Indiana Consumer Data Protection Act (ICDPA) IC 24-15; in force 1 Jan 2026 (P.L.94-2023)

The Indiana Consumer Data Protection Act is Indiana Code Article 24-15 (P.

Indiana, United States

Kentucky Consumer Data Protection Act (KCDPA) KRS 367.3611 to 367.3629; in force 1 Jan 2026 (2024 Ky. Acts ch. 72)

The Kentucky Consumer Data Protection Act is KRS 367.

Kentucky, United States

Louisiana Data Privacy Act (LDPA) La. R.S. 51:1780.1 to 1780.5 (Act 502 of 2026, SB 386); effective 1 Jan 2027 (not yet in force)

The Louisiana Data Privacy Act is La.

Louisiana, United States

Manitoba Personal Health Information Act (PHIA) C.C.S.M. c. P33.5; M.R. 245/97

The Personal Health Information Act (PHIA), C.

Manitoba, Canada

Manitoba Freedom of Information and Protection of Privacy Act (FIPPA) C.C.S.M. c. F175; M.R. 64/98

The Freedom of Information and Protection of Privacy Act (FIPPA), C.

Manitoba, Canada

Saskatchewan Health Information Protection Act (HIPA) S.S. 1999, c. H-0.021; H-0.021 Reg 2 (2023)

The Health Information Protection Act (HIPA), S.

Saskatchewan, Canada

Saskatchewan public sector privacy (FOIP and LA FOIP) S.S. 1990-91, c. F-22.01 and c. L-27.1

Saskatchewan public sector privacy is in two parallel statutes.

Saskatchewan, Canada

New Brunswick Personal Health Information Privacy and Access Act (PHIPAA) S.N.B. 2009, c. P-7.05; N.B. Reg. 2010-112

The Personal Health Information Privacy and Access Act (PHIPAA), S.

New Brunswick, Canada

New Brunswick Right to Information and Protection of Privacy Act (RTIPPA) S.N.B. 2009, c. R-10.6; N.B. Reg. 2010-111

The Right to Information and Protection of Privacy Act (RTIPPA), S.

New Brunswick, Canada

Canada's Anti-Spam Legislation (CASL) S.C. 2010, c. 23, current to 2026-09-30

Canada's Anti-Spam Legislation (CASL), S.

Canada

Canada National Do Not Call List and Telemarketing Rules (CRTC) Telecommunications Act ss. 41 to 41.7, current to 2026-09-30; CRTC Rules compilation modified 2014-03-31

The telemarketing rules for calls and faxes to Canadian consumers: Telecommunications Act ss.

Canada

CAN-SPAM Act and FTC CAN-SPAM Rule 15 U.S.C. 7701 to 7713; 16 CFR Part 316 (eCFR 2026-10-20)

The Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM) Act of 2003, 15 U.

United States

Telephone Consumer Protection Act (TCPA) and FCC Rules 47 U.S.C. 227; 47 CFR 64.1200 (eCFR 2026-10-20); FCC 26-67 effective 2026-11-25

The TCPA, 47 U.

United States

Maryland Online Data Privacy Act of 2024 (MODPA) Comm. Law 14-4601 to 14-4614 (Ch. 455, 2024)

The Maryland Online Data Privacy Act of 2024 (Commercial Law 14-4601 to 14-4614, Chapter 455 of 2024, SB 541), effective 1 October 2025.

Maryland, United States

Minnesota Consumer Data Privacy Act (MCDPA) Minn. Stat. 325M.10 to 325M.21 (2024)

The Minnesota Consumer Data Privacy Act (Minn.

Minnesota, United States

Montana Consumer Data Privacy Act (MCDPA) MCA 30-14-2801 to 2820 (2023, amended 2025)

The Montana Consumer Data Privacy Act (MCA 30-14-2801 to 30-14-2820, Chapter 681 Laws of 2023 as amended by Chapter 567 Laws of 2025).

Montana, United States

Nebraska Data Privacy Act (NDPA) LB 1074 (2024), ss. 1 to 30

The Nebraska Data Privacy Act (LB 1074 of 2024, ss.

Nebraska, United States

New Hampshire Expectation of Privacy Act (RSA 507-H) RSA 507-H:1 to 507-H:12 (SB 255, 2024)

The New Hampshire expectation of privacy law, RSA 507-H (SB 255, Chapter 5 of 2024), effective 1 January 2025.

New Hampshire, United States

Oklahoma Consumer Data Privacy Act (OCDPA) Enrolled SB 546 (2026); effective 1 Jan 2027

The Oklahoma Consumer Data Privacy Act, enrolled Senate Bill 546 of 2026, effective 1 January 2027.

Oklahoma, United States

Oregon Consumer Privacy Act (OCPA) ORS 646A.570 to 646A.589 (as amended 2025)

The Oregon Consumer Privacy Act (ORS 646A.

Oregon, United States

Rhode Island Data Transparency and Privacy Protection Act R.I. Gen. Laws 6-48.1-1 to 6-48.1-10 (2024)

The Rhode Island Data Transparency and Privacy Protection Act (R.

Rhode Island, United States

Tennessee Information Protection Act (TIPA) T.C.A. 47-18-3201 to 3213 (Pub. Ch. 408)

The Tennessee Information Protection Act (Tenn.

Tennessee, United States

Utah Consumer Privacy Act (UCPA) Utah Code 13-61-101 to 13-61-404 (2022)

The Utah Consumer Privacy Act (Utah Code 13-61-101 to 13-61-404), effective 31 December 2023.

Utah, United States

Vermont Data Privacy and Online Surveillance Act (VTDPOSA) Act 145 (2026); effective 1 Jan 2028

The Vermont Data Privacy and Online Surveillance Act (S.

Vermont, United States

Virginia Consumer Data Protection Act (VCDPA) Va. Code 59.1-575 to 59.1-584 (to 2026)

The Virginia Consumer Data Protection Act (Va.

Virginia, United States

NAIC Insurance Data Security Model Law (#668), state adoptions Model #668; state laws as read 24 Oct 2026

The NAIC Insurance Data Security Model Law (#668) is a model, not a law.

United States

Consumer health data laws: Washington, Nevada and Connecticut RCW 19.373 (2023 c 191); NRS 603A.400-.550; CT AG page

Three state laws regulate consumer health data held outside HIPAA, and they reach far past clinics: a shoe retailer’s fitness app or an online pharmacy ad network can be covered.

United States

Biometric privacy laws beyond Illinois and Texas RCW 19.375; C.R.S. 6-1-1314 (HB 24-1130); local ordinances

This framework covers biometric laws outside Illinois (BIPA, framework IL_BIPA) and Texas (CUBI, in TX_STATE), which are not repeated; where a control exists in those packs it is mapped by name.

United States

US state data breach notification: common elements and state differences State statutes and AG pages read 24 Oct 2026

Breach notification laws are generally reported to exist in all 50 states and the District of Columbia (this pack read the laws of about 35 of them), and they differ.

United States

Newfoundland and Labrador Personal Health Information Act (PHIA) SNL 2008, c P-7.01 (in force 1 Apr 2011)

Read 24 Oct 2026.

Newfoundland and Labrador, Canada

Newfoundland and Labrador Access to Information and Protection of Privacy Act, 2015 (ATIPPA) SNL 2015, c A-1.2 (amended to 2026 c16 s2)

Read 24 Oct 2026.

Newfoundland and Labrador, Canada

Prince Edward Island Health Information Act (HIA) RSPEI c H-1.41 (unofficial consolidation read)

Read 24 Oct 2026.

Prince Edward Island, Canada

Prince Edward Island Freedom of Information and Protection of Privacy Act (FOIPP) RSPEI 1988, c F-15.01 (unofficial consolidation read)

Read 24 Oct 2026.

Prince Edward Island, Canada

Quebec Act respecting health and social services information (S.Q. 2023, c. 5) SQ 2023, c 5 (main parts in force 1 Jul 2024)

Read 24 Oct 2026.

Quebec, Canada

Quebec Access Act, public sector (as modernized by Law 25) CQLR c A-2.1, as amended by SQ 2021, c 25

Read 24 Oct 2026.

Quebec, Canada

Yukon Health Information Privacy and Management Act (HIPMA) SY 2013, c 16 (statute text not read)

UNVERIFIED AGAINST THE STATUTE.

Yukon, Canada

Yukon Access to Information and Protection of Privacy Act (ATIPP Act) SY 2018, c 9 (statute text not read)

UNVERIFIED AGAINST THE STATUTE.

Yukon, Canada

Northwest Territories Health Information Act (HIA) SNWT 2014, c 2 (in force 1 Oct 2015)

PARTLY VERIFIED.

Northwest Territories, Canada

Northwest Territories Access to Information and Protection of Privacy Act (ATIPPA) SNWT 1994, c 20; amended SNWT 2019, c 8 (in force 30 Jul 2021)

PARTLY VERIFIED.

Northwest Territories, Canada

Nunavut Access to Information and Protection of Privacy Act (ATIPPA) SNWT 1994, c 20 as duplicated for Nunavut (2012 office consolidation)

PARTLY VERIFIED.

Nunavut, Canada

Canada Privacy Act (federal institutions) RSC 1985, c P-21 (current to 30 Sep 2026; amended 2 Jun 2025)

Read 24 Oct 2026.

Canada

Pennsylvania privacy, security and AI (sector tiers) Sector rules read 23 Oct 2026

Pennsylvania state-level privacy, security and AI rules for organizations that hold information about people in Pennsylvania, organized as one framework with seven sector tiers.

Pennsylvania, United States

Pennsylvania Breach of Personal Information Notification Act Act 94 of 2005, as amended 2022 and 2024

Pennsylvania Breach of Personal Information Notification Act, Act of December 22, 2005 (P.

Pennsylvania, United States

Privacy

CCPA / CPRA 2023

California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

California, United States

Alberta PIPA 2022

Alberta Personal Information Protection Act (PIPA).

Alberta, Canada

BC PIPA 2023

British Columbia Personal Information Protection Act (PIPA).

British Columbia, Canada

Quebec Law 25 (Private Sector Privacy) 2024

Quebec Act respecting the protection of personal information in the private sector, as amended by Bill 64 (Law 25).

Quebec, Canada

BC FIPPA 2023

British Columbia Freedom of Information and Protection of Privacy Act (FIPPA/FOIPPA).

British Columbia, Canada

EU GDPR 2018

General Data Protection Regulation (EU) 2016/679 — the world's strongest data privacy law.

European Union

UK GDPR / Data Protection Act 2018 2021

UK General Data Protection Regulation (retained EU law post-Brexit) together with the Data Protection Act 2018.

United Kingdom

Australian Privacy Act 1988 2024

Australian Privacy Act 1988 including the Australian Privacy Principles (APPs).

Australia

PIPEDA 2024

Personal Information Protection and Electronic Documents Act — Canada's federal private-sector privacy law.

Canada

Children's Online Privacy Protection Rule (COPPA) 16 CFR 312, amended 2025

Children's Online Privacy Protection Rule (COPPA Rule), 16 CFR Part 312, enforced by the US Federal Trade Commission.

United States

Consumer Privacy Protection Act (CPPA) - Draft, not in force Bill C-27 first reading (died 6 January 2025)

DRAFT, NOT IN FORCE, AND SUPERSEDED FOR PLANNING.

Canada

Protecting Privacy and Consumer Data Act (PPCDA) - Draft, Bill C-36, not in force Bill C-36 first reading (15 June 2026)

PROPOSED LAW, NOT IN FORCE.

Canada

Payment card

PCI DSS SAQ A v4.0.1

For card-not-present merchants (e-commerce, mail/telephone order) that have fully outsourced all cardholder data functions to PCI DSS compliant third-party service providers.

Global (applies anywhere)

PCI DSS SAQ A-EP v4.0.1

For e-commerce merchants with a website that redirects to a third-party payment processor.

Global (applies anywhere)

PCI DSS SAQ B v4.0.1

For merchants using only imprint machines or standalone dial-out terminals (no electronic cardholder data storage).

Global (applies anywhere)

PCI DSS SAQ B-IP v4.0.1

For merchants using only standalone, PCI PTS-approved point-of-interaction (POI) terminals with an IP connection to the payment processor.

Global (applies anywhere)

PCI DSS SAQ C v4.0.1

For merchants with payment application systems (e.

Global (applies anywhere)

PCI DSS SAQ C-VT v4.0.1

For merchants manually entering a single transaction at a time via a web-based virtual terminal provided by a PCI DSS compliant third-party service provider.

Global (applies anywhere)

PCI DSS SAQ D v4.0.1

Full PCI DSS assessment for merchants and service providers that do not meet the criteria for any other SAQ type.

Global (applies anywhere)

Energy & critical infrastructure

NERC CIP 7

North American Electric Reliability Corporation Critical Infrastructure Protection standards for the bulk electric system.

North America

Critical Cyber Systems Protection Act (Bill C-8) 2026

Canada's critical cyber systems law.

Canada

Canadian Oil & Gas / Energy Cyber Security 2026

The cyber and physical security expectations that fall on Canadian oil, gas, and pipeline operators.

Canada

US Pipeline & Energy Cyber Security (TSA) 2026

Cyber security requirements for US pipeline and energy operators.

United States

Government & public sector

Criminal justice

FBI CJIS Security Policy 6.1

The security requirements attached to criminal justice information.

United States

FBI CJIS Security Policy 5.9.5 (Pre-Modernization) 5.9.5

The last release of the pre-modernization CJIS Security Policy, published July 9, 2024, organized as thirteen numbered policy areas rather than NIST control families.

United States

Privacy, records & disclosure

Alberta Protection of Privacy Act (POPA) / Access to Information Act (AITA) 2025

Alberta's public sector privacy and access law.

Alberta, Canada

Ontario MFIPPA - Municipal Freedom of Information and Protection of Privacy Act (as amended by Bill 194) 2024 amendments

The Municipal Freedom of Information and Protection of Privacy Act, as amended by Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024.

Ontario, Canada

Iowa Public Sector Information Obligations 2026

What Iowa law asks of a city, county, or other governmental subdivision holding personal information and public records.

Iowa, United States

IRS Publication 1075 - Federal Tax Information 2024

The safeguards an organization must have in place to receive Federal Tax Information from the IRS.

United States

Accessibility

ADA Title II - Web and Mobile Accessibility 2024 Final Rule

The Department of Justice rule requiring the web content and mobile applications of state and local governments to conform to WCAG 2.

United States

Ontario AODA - Integrated Accessibility Standards (O. Reg. 191/11) O. Reg. 191/11, consolidated 30 March 2026

Ontario's accessibility standards for every organization with at least one employee in Ontario, with obligations that scale with size.

Ontario, Canada

WCAG 2.0 - Web Content Accessibility Guidelines 2.0 W3C Recommendation, 11 December 2008

The 2008 W3C accessibility standard that Ontario's AODA requires at Level AA for large and public sector websites.

Global (applies anywhere)

WCAG 2.2 - Web Content Accessibility Guidelines 2.2 W3C Recommendation, 12 December 2024 (first publis

The current W3C web accessibility standard, and the version W3C recommends you meet now.

Global (applies anywhere)

WCAG 3.0 Working Draft (10 September 2026) - DRAFT, not a standard W3C Working Draft, 10 September 2026 (draft)

A W3C Working Draft, not a standard. Measure readiness against its draft requirements; no one can claim conformance to it yet.

Global (applies anywhere)

Baselines & cloud assurance

NIST SP 800-53 - Security and Privacy Controls Rev. 5

The catalogue that most other North American frameworks are derived from.

Global (applies anywhere)

GovRAMP (formerly StateRAMP) - Cloud Vendor Assurance 2026

Standardized security assurance for cloud products sold to state, local, territorial, tribal, and education organizations.

United States

CCCS Cloud Control Profiles (ITSP.50.103) ITSP.50.103 Annexes A and B

Canadian Centre for Cyber Security cloud security control profiles, from ITSP.

Canada

CCCS Cloud Assessment: Medium and PBHVA Program page June 2026; ITSM.50.100

Cyber Centre Cloud Service Provider IT Security Assessment Program, at the Cloud Medium (formerly PBMM) and Protected B High Value Assets (PBHVA) levels.

Canada

CCCS Common Criteria Program (Product Certification) Program Instructions v2.3 (May 2025)

Canadian Common Criteria Program, run by the Canadian Centre for Cyber Security as Canada's Certification Body under the Common Criteria Recognition Arrangement (CCRA).

Canada

Critical public services

US Water & Wastewater Cyber Security (AWIA) 2026

Cyber and physical security requirements for community water systems, which in most of the United States means the municipality.

United States

Healthcare

HITRUST CSF 11

HITRUST Common Security Framework (CSF) v11 — a certifiable framework that provides organizations with a comprehensive, flexible, and efficient approach to regulatory/standards compliance and risk…

Global (applies anywhere)

HIPAA Security Rule 2024

The HIPAA Security Rule establishes national standards to protect individuals' electronic personal health information.

United States

BC E-Health Act 2024

British Columbia E-Health (Personal Health Information Access and Protection of Privacy) Act.

British Columbia, Canada

Alberta Health Information Act 2024

Alberta Health Information Act (HIA) requirements for custodians of health information.

Alberta, Canada

FDA Cybersecurity for Cyber Devices (Section 524B) 2026 guidance

Mandatory cybersecurity content for US premarket submissions.

United States

Health Canada Medical Device Cybersecurity June 2019 guidance

Health Canada's pre-market cybersecurity expectations for medical devices, from the Guidance Document "Pre-market Requirements for Medical Device Cybersecurity", finalized June 2019.

Canada

IEC 81001-5-1 Health Software Security Life Cycle 2021

The standard that defines what a secure development life cycle looks like for health software and health IT, published 2021.

Global (applies anywhere)

ANSI/AAMI SW96 Medical Device Security Risk Management 2023

The American National Standard for security risk management of medical devices, published November 2023, together with AAMI TIR57:2016/(R)2023, the technical information report it builds on.

United States

HSCC Medical Device and Health IT Joint Security Plan v2.0 (March 2024)

A voluntary secure-product-development framework written by the Healthcare and Public Health Sector Coordinating Council for the medical device and health IT sector, published March 2024.

Global (applies anywhere)

Ontario Personal Health Information Protection Act (PHIPA) 2004, as amended

Ontario's health privacy statute, the Personal Health Information Protection Act, 2004.

Ontario, Canada

AI governance

NIST AI Risk Management Framework 1.0 + GenAI Profile (NIST-AI-600-1)

Voluntary, vendor-neutral framework for governing, mapping, measuring, and managing risks of AI systems across their lifecycle.

Global (applies anywhere)

ISO/IEC 42001 - AI Management System (AIMS) 2023

The certifiable international standard for an Artificial Intelligence Management System - the AI equivalent of ISO 27001.

Global (applies anywhere)

EU Artificial Intelligence Act - Readiness Reg. (EU) 2024/1689

Readiness framework for the EU AI Act.

European Union

OWASP Top 10 for LLM Applications 2025

Technical security controls for applications that integrate large language models: prompt injection, sensitive information disclosure, supply chain, data/model poisoning, improper output handling,…

Global (applies anywhere)

Canada AI Governance Readiness 2026

Canadian AI governance readiness based on the federal Directive on Automated Decision-Making (in force; mandatory for federal automated decision systems and a strong voluntary baseline for the…

Canada

ISO/IEC 27090 - AI Security Threats and Compromises 2026

International guidance, published October 2026, for understanding, detecting and mitigating security threats specific to AI systems across their life cycle: data and model poisoning, evasion,…

Global (applies anywhere)

Financial services

FTC Safeguards Rule 2023

FTC Standards for Safeguarding Customer Information (16 CFR 314), revised 2023.

United States

GLBA: Gramm-Leach-Bliley Act 2023

Gramm-Leach-Bliley Act (GLBA) financial privacy and safeguards requirements for US financial institutions.

United States

NYDFS Cybersecurity Regulation 2023

New York Department of Financial Services Cybersecurity Regulation (23 NYCRR 500), amended 2023.

New York, United States

FINTRAC / PCMLTFA 2024

Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) requirements under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA).

Canada

EU DORA 2025

Digital Operational Resilience Act — Regulation (EU) 2022/2554, effective 17 January 2025.

European Union

BC Financial Services Authority Security Guidance 2024

British Columbia Financial Services Authority cybersecurity and technology risk management guidance.

British Columbia, Canada

CPA Canada Cybersecurity Framework 2024

CPA Canada guidance on cybersecurity risk management and reporting.

Canada

CIRO Cybersecurity Program - Dealer Members 2026

The cybersecurity obligations and expectations CIRO (the Canadian Investment Regulatory Organization) places on its Dealer Members.

Canada

CSA Staff Notice 33-322 - Registered Firm Cybersecurity 15 July 2026

The Canadian Securities Administrators' current cybersecurity expectations for registered firms, published 15 July 2026 after a review of 73 firms.

Canada

Looking for your own country, province, or state? Browse compliance and training by region.

See how Lavawall GRC works

We use privacy-friendly, cookieless analytics to count visits, and one cookie to run our live chat. Both load only if you accept. We do not use advertising trackers, and we do not profile you across other websites. The essential cookies that keep the site working are always on. See our privacy policy.