3GPP Security Assurance Specifications define the security requirements and test cases for mobile network functions, forming the technical evaluation basis used by the GSMA NESAS scheme for network equipment product security.

SecNumCloud is France's highest-level security qualification for cloud service providers, issued by ANSSI, requiring strict technical controls and digital sovereignty guarantees including immunity from non-European extraterritorial legislation.

The BSI Cloud Computing Compliance Criteria Catalogue (C5) is Germany's security standard for cloud service providers, defining audit requirements across 17 domains and increasingly mandated for KRITIS operators and the healthcare sector.

BSI IT-Grundschutz is Germany's comprehensive, prescriptive methodology for implementing an Information Security Management System, providing detailed building blocks and enabling ISO 27001 certification on the basis of IT-Grundschutz.

CIS Benchmarks are consensus-based, prescriptive security configuration guidelines published by the Center for Internet Security for operating systems, cloud platforms, containers, and network devices, widely used as hardening baselines.

Defense Information Systems Agency Security Technical Implementation Guides are prescriptive configuration standards mandated for US Department of Defense information systems, defining exact security settings for operating systems, applications, and network devices.

E-ITS is Estonia's national information security standard, replacing the former ISKE, providing a baseline protection methodology based on BSI IT-Grundschutz and aligned with ISO/IEC 27001 for all organizations performing public duties.

The Esquema Nacional de Seguridad is Spain's mandatory national security framework establishing minimum cybersecurity requirements for public sector information systems and their private-sector service providers, governed by Royal Decree 311/2022.

The European Cybersecurity Certification Scheme for Cloud Services is a voluntary EU-wide framework under the Cybersecurity Act, defining assurance levels for cloud service providers operating in the European market.

The EU Cyber Resilience Act is a mandatory European regulation imposing cybersecurity requirements on all products with digital elements placed on the EU market, covering their entire lifecycle from design to end-of-support.

The EU Cybersecurity Act is the foundational European regulation that established ENISA as a permanent agency and created the EU-wide cybersecurity certification framework for ICT products, services, and processes.

The EU5G cybersecurity certification scheme is an ENISA-led framework under development to provide EU-wide security assurance for 5G network equipment and components, complementing the EU Toolbox for 5G Security.

The European Common Criteria-based cybersecurity certification scheme is the first adopted EU-wide certification framework under the Cybersecurity Act, providing a harmonized evaluation methodology for ICT products across all Member States.

The Federal Risk and Authorization Management Program is the US government's standardized approach to security assessment and authorization for cloud services, based on NIST 800-53 and mandatory for any cloud product handling federal data.

FIPS 140 is the US federal standard for cryptographic module validation, jointly administered by NIST and the Canadian CCCS, mandatory for any cryptographic protection of sensitive government information in the United States and Canada.

The GSMA Network Equipment Security Assurance Scheme is a voluntary, global industry framework that evaluates telecom vendors' development processes and network products against security baselines defined by 3GPP SCAS specifications.

The Health Insurance Portability and Accountability Act is a US federal law mandating the protection of individuals' health information, imposing security, privacy, and breach notification requirements on covered entities and their business associates.

ISO/IEC 27001 is the international standard for Information Security Management Systems, specifying requirements for establishing, implementing, maintaining, and continually improving an ISMS, with formal certification through accredited bodies.

KRITIS is Germany's regulatory framework for the protection of critical infrastructure, combining the NIS2-implementing BSI-Gesetz for cybersecurity with the KRITIS-Dachgesetz for physical resilience, enforced by the BSI and BBK.

The NIS2 Directive is the EU's revised Network and Information Security legislation mandating cybersecurity risk management, incident reporting, and supply chain security for essential and important entities across 18 critical sectors.

NIST Special Publication 800-53 is the US federal catalog of security and privacy controls for information systems, providing the authoritative control baseline referenced by FedRAMP, FISMA, and numerous international frameworks.

The Payment Card Industry Data Security Standard is a global, mandatory security standard for any organization that stores, processes, or transmits cardholder data, governed by the PCI Security Standards Council and enforced by payment card brands.

SOC 2 is an auditing framework developed by the AICPA for service organizations, evaluating the design and operational effectiveness of controls across five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

The Verschlusssachenanweisung (VSA) and VS-NfD-Merkblatt govern the handling of German classified information at the lowest classification level, requiring BSI-approved IT security products, IT-Grundschutz implementation, and mandatory self-accreditation for private-sector contractors.