22 compliance frameworks included in every edition - free, open, and continuously updated. No licence required to run any of them.
The General Data Protection Regulation is the European Union's primary law governing
the collection, processing, and storage of personal data for EU residents. It applies
to any organisation - worldwide - that processes EU citizen data.
Assessment benefit: SWAO evaluates 47 controls covering data residency
enforcement, consent management, retention policies, encryption at rest and in transit,
data subject rights, and breach notification readiness. Each finding cites the specific
GDPR article and the code or configuration that triggered it.
The Health Insurance Portability and Accountability Act establishes US federal
requirements for protecting Protected Health Information (PHI) in any system that
stores, transmits, or processes patient data. Mandatory for all US healthcare entities
and their business associates.
Assessment benefit: SWAO checks administrative, physical, and technical
safeguards - ePHI encryption, workforce access controls, audit logging, automatic
logoff, data backup, and disaster recovery configurations - against the HIPAA Security
Rule's required and addressable implementation specifications.
Accenture's Responsible AI framework defines ten pillars for building and deploying AI
systems that are fair, transparent, and accountable. It covers the full AI lifecycle --
from data sourcing and model design through deployment and monitoring.
Assessment benefit: SWAO assesses AI and ML workloads against all ten
pillars: fairness, transparency, explainability, robustness, privacy, security,
reliability, inclusiveness, accountability, and sustainability. Identifies gaps in
model governance, bias controls, explainability tooling, and audit logging.
The BSI Cloud Computing Compliance Criteria Catalogue (C5) is the German Federal
Office for Information Security's standard for cloud service providers operating in
Germany. It covers 17 security domains and is a prerequisite for public sector
procurement in Germany.
Assessment benefit: SWAO evaluates 62 controls across all 17 BSI C5
domains - from organisation and personnel through cryptography, network security,
logging, and business continuity. Essential for cloud providers serving German public
or regulated private sector clients.
The Digital Operational Resilience Act (Regulation EU 2022/2554) has been mandatory since
17 January 2025 for banks, insurers, investment firms, payment institutions, and ICT
third-party providers operating in the EU.
Assessment benefit: SWAO evaluates 31 controls across 5 pillars: ICT
risk management, incident reporting, resilience testing, TPP risk, and information
sharing - surfacing gaps and evidence requirements for each pillar.
The ENISA EU Cloud Security Certification Scheme - 66 controls across 12 security
domains at three assurance levels (Basic, Substantial, High). The primary EU-wide
cloud security certification for IaaS, PaaS, and SaaS providers.
Assessment benefit: SWAO maps your cloud service posture to the EUCS
assurance level required by EU customers or authorities, surfacing domain gaps at the
correct assurance tier.
NIS2 (Directive 2022/2555) applies to medium and large essential and important entities
across 18 EU sectors, with transposition deadline October 2024. Its ten minimum security
measures (Art. 21) and three-tier incident reporting (Art. 23) are the core obligations.
Assessment benefit: SWAO evaluates 46 controls covering all Art. 21
measures - from access control and cryptography to supply chain security and business
continuity - with evidence indicators per control.
Regulation EU 2024/1689 in force since August 2024. Prohibited AI practices apply from
February 2025; high-risk AI system obligations apply from August 2027. Covers risk
classification, high-risk requirements, transparency, and GPAI model obligations.
Assessment benefit: SWAO runs Risk Classification first, then evaluates
only the applicable downstream controls - HR for high-risk systems, TR for limited-risk
and above, GP for GPAI models. 37 controls total.
NIST Special Publication 800-66 Revision 2 provides prescriptive implementation
guidance for the HIPAA Security Rule. Where HIPAA defines the regulatory requirements,
NIST SP 800-66 R2 specifies concrete technical controls - making it the reference of
choice for healthcare organisations seeking NIST alignment alongside HIPAA compliance.
Assessment benefit: 9 control families and 66 individual controls
across Access Control (AC), Audit and Accountability (AU), Configuration Management
(CM), Contingency Planning (CP), Identification and Authentication (IA), Incident
Response (IR), Risk Assessment (RA), System and Communications Protection (SC), and
System and Information Integrity (SI). Run alongside the HIPAA framework for a complete
regulatory and implementation-guidance picture.
ISO/IEC 27001:2022 is the international standard for Information Security Management
Systems. The 2022 revision restructured the control set into 93 controls across four
themes - Organisational, People, Physical, and Technological - adding 11 new controls
for cloud security, threat intelligence, and data masking.
Assessment benefit: SWAO evaluates 93 controls with 14 cloud-relevant
controls marked as CSP-inherited, giving a clear split between what your workload must
demonstrate and what your cloud provider already covers by default.
BSI IT-Grundschutz provides modular, prescriptive IT security guidance for German
public sector organisations and regulated enterprises. Security measures are organised
into building blocks (Bausteine) covering infrastructure, systems, applications, and
organisation - forming the basis for BSI certification in Germany.
Assessment benefit: SWAO maps workloads to the cloud-relevant
IT-Grundschutz building blocks covering server security, network, web services,
identity, and logging - surfacing gaps against the 2023 edition requirements.
The AICPA Trust Services Criteria define the security baseline for SaaS and cloud
service providers demonstrating controls to enterprise customers. Five TSC categories
cover Security (CC), Availability, Processing Integrity, Confidentiality, and Privacy.
Security is mandatory; the remaining categories are selected per engagement scope.
Assessment benefit: SWAO evaluates 64 controls across all five TSC
categories, producing evidence indicators suitable for Type II audit sampling periods.
Security category findings align directly with GDPR and ISO 27001 outputs.
Regulation EU 2024/2847 introduces mandatory cybersecurity requirements for all
hardware and software products with digital elements sold in the EU. Critical products
(class I/II) must comply from June 2027; all other products from December 2027. Annex I
defines security requirements and vulnerability handling obligations.
Assessment benefit: SWAO evaluates 35 controls covering secure design,
default configuration, vulnerability disclosure, SBOM completeness, and incident
reporting timelines against both Annex I Part I (security) and Part II (vulnerability
handling) obligations.
KRITIS-DE implements BSIG ยง8a obligations for operators of critical infrastructure
in Germany across 10 sectors - energy, water, transport, health, finance, food,
and digital infrastructure. Operators must apply state-of-the-art IT security measures
and submit proof of compliance every two years to BSI.
Assessment benefit: SWAO evaluates 40 controls across 7 domains:
governance, risk management, incident response, business continuity, supply chain,
physical security, and technical controls - producing the evidence package required
for the biennial BSI audit submission.
The Open Source Security Foundation Scorecard defines 17 automated security checks
covering supply chain integrity, CI/CD security, dependency management, vulnerability
response, and code review practices. Weighted scoring produces a 0-10 summary score
used in procurement decisions and supply chain risk assessments.
Assessment benefit: SWAO runs all 17 Scorecard checks against
application source repositories, identifying missing branch protection, unsigned
artefacts, unpinned dependencies, and absent security policies - with per-check
remediation guidance.
PCI DSS 4.0.1 is mandatory for any organisation that stores, processes, or transmits
payment card data. The 2024 revision introduced 64 new requirements focused on targeted
risk analysis, customised implementation, and stronger authentication. All PCI DSS
v3.2.1 deadline extensions expired in March 2025.
Assessment benefit: SWAO evaluates workloads against all 12 PCI DSS
requirements - from network segmentation and cardholder data protection through access
control, monitoring, and penetration testing requirements - flagging in-scope components
and control gaps.
The Saudi Arabian Monetary Authority Cyber Security Framework v1.0 is mandatory for
all SAMA-regulated financial institutions - banks, insurance companies, fintech
providers, and payment processors. Five domains cover Leadership and Governance, Risk
Management and Compliance, Operations, Third-Party Risk, and Cyber Resilience.
Assessment benefit: SWAO evaluates controls across all five SAMA
domains, identifying gaps in cloud governance, third-party vendor risk, incident
response readiness, and resilience architecture for Saudi-regulated financial workloads.
The Saudi National Cybersecurity Authority Cloud Cybersecurity Controls v2.0 (CSP
edition) defines mandatory requirements for cloud service providers operating in Saudi
Arabia, particularly those serving public sector or critical infrastructure clients.
Updated in 2024 with stronger controls for data localisation and supply chain security.
Assessment benefit: SWAO evaluates CSP-side controls covering data
residency, isolation, logging, penetration testing, cryptography, and incident
reporting - with Saudi data localisation requirements explicitly flagged per control.
The NCA Cloud Cybersecurity Controls v2.0 (Tenant edition) defines security obligations
for organisations consuming cloud services in Saudi Arabia. It complements the CSP
edition by addressing tenant responsibilities for access management, data classification,
configuration, and incident response within shared cloud environments.
Assessment benefit: SWAO evaluates tenant-side controls covering
identity and access management, data classification, security configuration, monitoring,
and shared-responsibility boundary awareness for Saudi cloud deployments.
The NCA Essential Cybersecurity Controls v2.0 are mandatory for all Saudi government
entities and critical national infrastructure operators. Five domains cover
Cybersecurity Governance, Risk Management, Compliance, Human Aspects, and Technology
Controls - establishing the baseline cybersecurity floor for Saudi digital government.
Assessment benefit: SWAO evaluates workloads against ECC controls
covering asset management, access control, vulnerability management, secure
configuration, logging, and incident response - producing a gap analysis against
Saudi government compliance requirements.
Accenture's LLM Selection framework provides sovereignty benchmarking criteria for
evaluating AI and large language model providers. It assesses data residency, training
data jurisdiction, fine-tuning data handling, inference endpoint location, and
contractual data processing guarantees - enabling informed LLM provider selection
under sovereign or regulated workload constraints.
Assessment benefit: SWAO evaluates LLM-integrated workloads against
provider-specific sovereignty criteria, surfacing risks when inference or training
data crosses jurisdictional boundaries relevant to GDPR, NIS2, or national AI
regulations.
SecNumCloud v3.2 is the ANSSI qualification scheme for sovereign cloud services in
France and a reference standard for EU sovereign cloud procurement. Nine qualified
providers hold or pursue qualification. Its 65 controls across 19 chapters cover
governance, supply chain, physical, technical, and operational security at the
highest EU sovereign cloud assurance tier.
Assessment benefit: SWAO evaluates landing zone and governance
posture against SecNumCloud chapter requirements, identifying gaps for organisations
seeking qualification or procuring from qualified providers under French or EU
sovereign cloud mandates.
The European Commission Cloud Sovereignty Framework v1.2.1 (October 2025) defines
sovereignty requirements for cloud procurement across EU institutions. Eight SOV
domains - Strategic, Legal, Data, Operational, Supply Chain, Technology, Security,
and Environmental - are assessed at SEAL-0 to SEAL-4 maturity levels. Used in
EUR 180M EU institutional cloud procurement.
Assessment benefit: SWAO evaluates 40 controls across all eight SOV
domains, producing a SEAL maturity score per domain and an overall sovereignty posture
profile for organisations procuring or delivering EU institutional cloud services.
