GCC Policy & Process
Qatar NIA
National Cyber Security Agency (NCSA)
354 controls · 26 domains
GCC Policy & Process
UAE IA
Cybersecurity Council / SIA (ex-NESA)
188 controls · 15 domains
International Pass / fail
CIS Controls
International
153 controls · 18 domains
GCC Policy & Process
NCA ECC-2
National Cybersecurity Authority (NCA)
109 controls · 28 domains
EU Policy & Process
GDPR (EU)
European Commission / EDPB
99 controls · 11 domains
UK Policy & Process
UK GDPR
ICO
99 controls · 11 domains
International Pass / fail
ISO 27001
International
93 controls · 4 domains
International Policy & Process
PCI DSS 4.0.1
PCI SSC
66 controls · 14 domains
GCC Policy & Process
NCA CCC
National Cybersecurity Authority (NCA)
55 controls · 24 domains
GCC Policy & Process
ADHICS
Department of Health – Abu Dhabi (DoH)
47 controls · 11 domains
International Operational Technology
NCA OTCC
National Cybersecurity Authority (NCA)
47 controls · 23 domains
GCC Policy & Process
SAMA CSF
Saudi Central Bank (SAMA)
32 controls · 4 domains
GCC Policy & Process
Data protection rules — Kuwait
CITRA
29 controls · 8 domains
GCC Policy & Process
PDPL — UAE
UAE Data Office
29 controls · 8 domains
GCC Policy & Process
PDPL — Bahrain
PDPA
29 controls · 8 domains
GCC Policy & Process
PDPL — Oman
MTCIT
29 controls · 8 domains
GCC Policy & Process
PDPL — Saudi Arabia
SDAIA
29 controls · 8 domains
GCC Policy & Process
PDPPL — Qatar
NCSA / CDP
29 controls · 8 domains
International Reference
NIST CSF
US / International
22 controls · 6 domains
US Policy & Process
HIPAA Security Rule
HHS OCR
18 controls · 3 domains
EU Policy & Process
NIS2
ENISA / national CSIRTs
10 controls · 1 domain
UK Policy & Process
Cyber Essentials
NCSC / IASME
5 controls · 1 domain
UK Policy & Process
Cyber Essentials Plus
NCSC / IASME
5 controls · 1 domain
International Reference
IEC 62443
International
212 controls · 16 domains
US Pass / fail
CJIS
FBI CJIS Division
172 controls · 18 domains
GCC Policy & Process
Dubai ISR
Dubai Electronic Security Center (DESC)
93 controls · 13 domains
GCC Technology & Threats
Kuwait NCF
CITRA + NCSC; CBK (banks)
34 controls · 2 domains
GCC Policy & Process
Oman NCF
MTCIT / OCERT / Cyber Defence Centre
26 controls · 4 domains
GCC Policy & Process
Bahrain NCSC
National Cyber Security Centre (NCSC); CBB (finance)
19 controls · 2 domains
EU Policy & Process
DORA
ESAs (EBA/ESMA/EIOPA)
17 controls · 5 domains
GCC Policy & Process
CBUAE CSF
Central Bank of the UAE (CBUAE)
13 controls · 3 domains
Threat & attack models
Catalogued separately — these describe how adversaries attack rather than prescribing controls, so they are not counted among the compliance frameworks above. They connect attacker techniques to the controls that reduce them.
Threat model Reference
MITRE ATT&CK
MITRE
216 techniques
Threat model Reference
UKC
Paul Pols / unifiedkillchain.com
18 techniques
All 31 frameworks are available on the platform.
Start your free trial →