The rules that apply to you
Four markets, and the frameworks that govern the buyer
An ISMS manager does not work in one regime. This page names the frameworks that commonly become the audit criteria beside ISO/IEC 27001, in the order United States, European Union, United Kingdom and Australia, each chosen by scanning the set of frameworks this site reads for the buyer's activity and data. The attribute view is a way to present the controls that meet them; it is not a substitute for any of them.
How these were chosen
The frameworks were selected by scanning the compliance set this site reads for the activity and data an ISMS manager handles: information security controls, privacy, audit evidence, critical infrastructure and certification. The scan was run on 20 October 2026 for each market in turn. The choice follows the buyer, not a fixed list, and where a market's regime is not in the record the page says so rather than stating it.
ISO/IEC 27028 is guidance in the ISO/IEC 27000 family. It is not a law, it implements no regime, and it creates no obligation in any of the four markets. What it does is give a method for presenting the controls that do meet those obligations.
United States
The US frameworks in this record that matter to an ISMS manager recording attributes. Neither is mandatory for a private organisation; both are common audit criteria and both use a control-and-evidence structure the register can serve.
| Framework | Why it matters to this buyer |
|---|---|
| NIST Cybersecurity Framework 2.0 | The voluntary framework most US organisations already use. Its functions sit alongside the five cybersecurity concept values, so a control view built for one can be read by the other. |
| NIST SP 800-53 Rev 5 | The federal control catalogue, used well beyond federal systems. Its control families are the place a US auditor will look for evidence that a control operates. |
European Union
EU obligations that commonly become audit criteria beside ISO/IEC 27001 for the buyer's data and sector. The guidance does not implement any of them; it helps present the controls that do.
| Framework | Why it matters to this buyer |
|---|---|
| GDPR | Personal data is in scope of most ISMS control sets, and the attribute view is one way to show which controls protect confidentiality, integrity and availability of personal data. |
| NIS2 Directive | For essential and important entities, the management measures overlap the 27002 control set; the attribute view helps map a control to the measure it evidences. |
| DORA | For financial entities, the ICT risk requirements are audited against evidence an ISMS already holds; the attribute view is a filter, not a new obligation. |
United Kingdom
UK criteria an ISMS audit may test alongside ISO/IEC 27001. The regime is named in the record; the guidance is not a substitute for either.
| Framework | Why it matters to this buyer |
|---|---|
| UK GDPR | The UK data protection regime applies to personal data in the ISMS scope; the properties attribute is the link between a control and the data it protects. |
| UK NCSC Cyber Assessment Framework | Used in regulated sectors and critical national infrastructure. Its outcome structure maps cleanly to a control-and-attribute view for board reporting. |
Australia
Australian criteria an ISMS audit may test. Where a market's regime is not in the record, the page names it and does not state it.
| Framework | Why it matters to this buyer |
|---|---|
| Privacy Act 1988 (Australia) | The Australian privacy regime applies to personal information in the ISMS scope and is commonly audited beside the management system. |
| ACSC Essential Eight | The Australian maturity model for eight mitigation strategies. Its strategies are a subset of the control set, and the attribute view is a way to show which of the 93 controls carry them. |
| Security of Critical Infrastructure Act 2018 (SOCI) | For critical infrastructure assets, the risk management programme is the obligation; the ISMS controls and their evidence are how it is shown. |
Where a regime is not in the record
This site does not state a requirement from a framework that is not in the record. Where the scan returned no framework in the record for a market's specific sector, the market section names the framework that applies and points to the official source rather than paraphrasing it. A named reference is not a statement of its requirements.
Nothing on this page is legal advice. Check the official text of each instrument before you rely on it.