# Secure iQube > Secure iQube is an independent ISO, SOC and compliance consultancy. We help organisations worldwide prepare for certification and attestation, gap assessments, implementation, documentation, internal audit, training and managed compliance. Key facts: - Legal name: Secure iQube Consulting Pvt. Ltd.; founded 2023-11; founder and CEO Chitra Chari. - Independent consultancy and training provider. Secure iQube does NOT issue ISO certificates: those come from accredited certification bodies (e.g. BSI, DNV, TÜV, LRQA, Intertek, SGS). SOC 1, SOC 2 and ISAE reports are issued by licensed CPA and audit firms; Secure iQube can arrange these end to end through its partner CPA firms, or work with the client's own firm. - Serves clients worldwide; remote-first delivery with on-site visits. - Contact: info@securei3.com, +91 90435 37131, https://securei3.com/contact/ - Coverage: the site lists the most requested standards and laws; Secure iQube supports many more on request. - ISO transition deadlines tracker (ISO 9001:2026, ISO 14001:2026, ISO 37001:2025, ISO/IEC 27701:2025, ISO 45001 revision and more): https://securei3.com/transitions.md - Every page below has a plain-markdown version (same URL ending in .md). Full content in one file: https://securei3.com/llms-full.txt ## Information security & privacy - [ISO/IEC 27001: Information security management systems](https://securei3.com/standards/iso-27001.md): The international benchmark for managing information security risk, and the certificate enterprise buyers ask for first. - [ISO/IEC 27701: Privacy information management systems](https://securei3.com/standards/iso-27701.md): A certifiable privacy management system that turns GDPR, DPDP, PDPL and other privacy laws into everyday practice. - [ISO/IEC 27017: Cloud security controls](https://securei3.com/standards/iso-27017.md): Cloud-specific security controls for providers and customers, usually certified as an extension of ISO 27001. - [ISO/IEC 27018: Protection of personal data in public clouds](https://securei3.com/standards/iso-27018.md): A code of practice for public cloud providers that process personal data on behalf of customers. - [ISO/IEC 27002: Information security controls guidance](https://securei3.com/standards/iso-27002.md): Implementation guidance for the 93 controls referenced in ISO/IEC 27001 Annex A. - [ISO/IEC 27005: Information security risk management guidance](https://securei3.com/standards/iso-27005.md): Guidance for running information security risk assessment and treatment that satisfies ISO 27001. - [ISO/IEC 27035: Information security incident management](https://securei3.com/standards/iso-27035.md): Guidance for preparing for, detecting, responding to and learning from security incidents. - [ISO/IEC 27036: Information security for supplier relationships](https://securei3.com/standards/iso-27036.md): Guidance for managing security risks across suppliers, outsourcing and the ICT supply chain. - [ISO/IEC 27032: Cybersecurity guidelines](https://securei3.com/standards/iso-27032.md): Guidance on internet security and cooperation between stakeholders in cyberspace. - [ISO/IEC 27019: Information security for the energy utility industry](https://securei3.com/standards/iso-27019.md): Sector controls for process control systems in electricity, gas and heat utilities. - [ISO 27799: Health informatics: information security management in health](https://securei3.com/standards/iso-27799.md): Guidance applying ISO 27002 controls to protect personal health information. - [ISO/IEC 29100: Privacy framework](https://securei3.com/standards/iso-29100.md): Common privacy principles and terminology that underpin privacy programmes and ISO 27701. ## Cybersecurity frameworks - [NIST CSF 2.0: NIST Cybersecurity Framework 2.0](https://securei3.com/standards/nist-csf.md): The widely adopted cybersecurity framework, now with a Govern function, used worldwide to measure and improve cyber maturity. - [TISAX: Trusted Information Security Assessment Exchange (ENX / VDA ISA)](https://securei3.com/standards/tisax.md): The automotive industry’s information security assessment, required by many OEMs from suppliers. - [SWIFT CSP: SWIFT Customer Security Programme (CSCF)](https://securei3.com/standards/swift-csp.md): Mandatory annual security attestation for every financial institution connected to the SWIFT network. - [IEC 62443: Security for industrial automation and control systems](https://securei3.com/standards/iec-62443.md): The international standard series for operational technology (OT) and industrial control system security. - [CIS Controls v8.1: CIS Critical Security Controls](https://securei3.com/standards/cis-controls.md): Eighteen prioritised safeguards with implementation groups for organisations of every size. - [NIST SP 800-53: NIST Security and Privacy Controls for Information Systems](https://securei3.com/standards/nist-800-53.md): The detailed US federal control catalogue used for government systems and many regulated programmes. - [CMMC 2.0: US Cybersecurity Maturity Model Certification](https://securei3.com/standards/cmmc.md): Cybersecurity certification for US Department of Defense contractors handling federal contract or controlled unclassified information. - [Cyber Essentials: UK Cyber Essentials and Cyber Essentials Plus](https://securei3.com/standards/cyber-essentials.md): The UK government-backed scheme proving basic cyber hygiene, required for many UK public contracts. - [COBIT 2019: COBIT framework for governance and management of enterprise IT](https://securei3.com/standards/cobit.md): ISACA’s framework for governing and managing enterprise IT, widely used by IT auditors. ## AI & digital trust - [ISO/IEC 42001: Artificial intelligence management systems](https://securei3.com/standards/iso-42001.md): The first certifiable standard for governing AI responsibly, for companies that build, buy or deploy AI. - [ISO/IEC 23894: AI risk management guidance](https://securei3.com/standards/iso-23894.md): Guidance on managing AI-specific risks, building on ISO 31000. - [ISO/IEC 42005: AI system impact assessment](https://securei3.com/standards/iso-42005.md): Guidance on assessing how AI systems affect individuals, groups and society. - [ISO/IEC 38507: Governance implications of the use of AI by organisations](https://securei3.com/standards/iso-38507.md): Guidance for boards and executives on governing the use of AI. - [NIST AI RMF: NIST AI Risk Management Framework](https://securei3.com/standards/nist-ai-rmf.md): A voluntary framework for managing AI risks, with a profile for generative AI. ## Attestation & assurance - [SOC 2: Trust Services Criteria attestation](https://securei3.com/standards/soc-2.md): The security attestation report North American customers expect from SaaS and service providers. - [SOC 1: Controls relevant to financial reporting](https://securei3.com/standards/soc-1.md): An attestation report on controls at a service organisation that affect customers’ financial statements. - [ISAE 3402: Assurance reports on controls at a service organisation](https://securei3.com/standards/isae-3402.md): The international equivalent of SOC 1, common in Europe, the Middle East and Asia. - [ISAE 3000: Assurance engagements other than audits of historical financial information](https://securei3.com/standards/isae-3000.md): The international assurance standard used for security, privacy and other non-financial control reports, often as the global counterpart to SOC 2. - [SOC 3: General-use Trust Services report](https://securei3.com/standards/soc-3.md): A public, summary version of SOC 2 you can post on your website. - [PCI DSS: Payment Card Industry Data Security Standard](https://securei3.com/standards/pci-dss.md): Mandatory security requirements for any organisation that stores, processes or transmits payment card data. - [HITRUST: HITRUST CSF assessments and certification](https://securei3.com/standards/hitrust.md): A certifiable security framework widely required by US healthcare organisations. - [CSA STAR: Cloud Security Alliance Security, Trust, Assurance and Risk programme](https://securei3.com/standards/csa-star.md): Cloud assurance based on the Cloud Controls Matrix, from self-assessment to third-party certification. ## Governance, risk & compliance - [ISO 37001: Anti-bribery management systems](https://securei3.com/standards/iso-37001.md): A certifiable framework to prevent, detect and respond to bribery across your organisation and business partners. - [ISO 37301: Compliance management systems](https://securei3.com/standards/iso-37301.md): A certifiable framework for managing all your legal, regulatory and contractual obligations in one place. - [ISO 31000: Risk management guidelines](https://securei3.com/standards/iso-31000.md): Principles and a process for enterprise risk management that every ISO management system builds on. - [ISO 19011: Guidelines for auditing management systems](https://securei3.com/standards/iso-19011.md): The international guidance for planning and running management system audits, revised in 2026 with more on remote and technology-assisted auditing. - [ISO 37000: Governance of organisations](https://securei3.com/standards/iso-37000.md): Principles for effective, ethical and accountable governance by boards and governing bodies. - [ISO 37002: Whistleblowing management systems](https://securei3.com/standards/iso-37002.md): Guidance for building a trusted speak-up programme, receiving, assessing and addressing concerns. - [ISO 30301: Management systems for records](https://securei3.com/standards/iso-30301.md): A certifiable management system for creating, controlling and retaining records. ## Financial crime, fraud & AML - [AML/CFT programme: Anti-money laundering and counter-terrorist financing compliance programme](https://securei3.com/standards/aml-cft-programme.md): A risk-based AML/CFT programme: risk assessment, CDD, monitoring, screening, reporting, training and independent testing. - [FATF Recommendations: Financial Action Task Force international AML/CFT standards](https://securei3.com/standards/fatf-recommendations.md): The global standards on which national AML laws are built, including the risk-based approach. - [Sanctions compliance: Economic and trade sanctions compliance programme](https://securei3.com/standards/sanctions-compliance.md): Screening, risk assessment and controls to comply with UN, US, EU, UK and local sanctions regimes. - [Fraud risk management: Fraud risk management programme (COSO/ACFE-aligned)](https://securei3.com/standards/fraud-risk-management.md): A structured programme to prevent, detect and respond to internal and external fraud. - [ISO/TS 37008: Internal investigations of organisations](https://securei3.com/standards/iso-37008.md): Guidance on conducting fair, confidential and well-documented internal investigations. ## Business continuity & resilience - [ISO 22301: Business continuity management systems](https://securei3.com/standards/iso-22301.md): Keep critical services running through disruption, and prove it to customers and regulators. - [ISO 22313: Business continuity management systems guidance](https://securei3.com/standards/iso-22313.md): Practical guidance on implementing the requirements of ISO 22301. - [ISO/TS 22317: Business impact analysis guidelines](https://securei3.com/standards/iso-22317.md): Guidance on running a business impact analysis, the foundation of continuity planning. - [ISO 22316: Organisational resilience principles](https://securei3.com/standards/iso-22316.md): Principles and attributes that help organisations anticipate, respond and adapt to change. - [ISO 22320: Emergency and incident management guidelines](https://securei3.com/standards/iso-22320.md): Guidance on command, control, coordination and cooperation during incidents and emergencies. - [ISO/IEC 27031: ICT readiness for business continuity](https://securei3.com/standards/iso-27031.md): Guidance on making IT services ready to support continuity, including disaster recovery. - [ISO 28000: Security and resilience: security management systems](https://securei3.com/standards/iso-28000.md): A certifiable security management system, widely used for supply chain security. - [ISO 22361: Crisis management guidelines](https://securei3.com/standards/iso-22361.md): Guidance on building a crisis management capability that leaders can rely on. ## Quality & service excellence - [ISO 9001: Quality management systems](https://securei3.com/standards/iso-9001.md): The world’s most widely used management standard, consistent products, services and customer satisfaction. - [ISO/IEC 20000-1: IT service management systems](https://securei3.com/standards/iso-20000-1.md): A certifiable standard for delivering reliable, well-governed IT services. - [ISO 9004: Quality of an organisation: guidance to achieve sustained success](https://securei3.com/standards/iso-9004.md): Guidance for going beyond ISO 9001 towards sustained success, with a self-assessment tool. - [ISO 10002: Customer satisfaction: complaints handling guidelines](https://securei3.com/standards/iso-10002.md): Guidance for fair, fast and transparent complaints handling. - [ISO 10004: Customer satisfaction: monitoring and measuring](https://securei3.com/standards/iso-10004.md): Guidance on measuring customer satisfaction in a way that drives decisions. - [ISO 18295: Customer contact centres](https://securei3.com/standards/iso-18295.md): Service requirements for customer contact centres and the clients who use them. - [ISO 56001: Innovation management systems](https://securei3.com/standards/iso-56001.md): The first certifiable standard for managing innovation systematically. - [ISO 21500: Project, programme and portfolio management guidance](https://securei3.com/standards/iso-21500.md): International guidance on project management concepts and processes. - [ITIL 4: ITIL 4 IT service management framework](https://securei3.com/standards/itil-4.md): The most widely used IT service management good-practice framework. ## Sector standards & accreditation - [ISO 22000: Food safety management systems](https://securei3.com/standards/iso-22000.md): Food safety management across the supply chain, combining HACCP with a management system. - [ISO 13485: Medical devices quality management](https://securei3.com/standards/iso-13485.md): The quality management standard regulators expect from medical device manufacturers and suppliers. - [ISO 14971: Medical devices: application of risk management](https://securei3.com/standards/iso-14971.md): The risk management process regulators expect for medical devices. - [ISO 15189: Medical laboratories: quality and competence](https://securei3.com/standards/iso-15189.md): Accreditation standard for medical laboratories, granted in India by NABL. - [ISO/IEC 17025: Testing and calibration laboratories](https://securei3.com/standards/iso-17025.md): The competence standard for testing and calibration labs, accredited nationally (NABL in India). - [IATF 16949: Automotive quality management systems](https://securei3.com/standards/iatf-16949.md): The automotive industry’s quality standard, required by most OEMs from production suppliers. - [AS 9100: Aerospace quality management systems](https://securei3.com/standards/as9100.md): The aerospace and defence quality standard based on ISO 9001. - [FSSC 22000: Food Safety System Certification 22000](https://securei3.com/standards/fssc-22000.md): GFSI-recognised food safety certification built on ISO 22000. - [ISO 21001: Educational organisations management systems](https://securei3.com/standards/iso-21001.md): A certifiable management system for schools, universities and training providers. - [ISO 29993: Learning services outside formal education](https://securei3.com/standards/iso-29993.md): Service requirements for training providers, from corporate academies to online courses. - [ISO 41001: Facility management systems](https://securei3.com/standards/iso-41001.md): A certifiable management system for facility management services. - [ISO 55001: Asset management systems](https://securei3.com/standards/iso-55001.md): A certifiable system for managing physical and infrastructure assets over their life cycle. - [ISO 19650: Information management using building information modelling (BIM)](https://securei3.com/standards/iso-19650.md): The international standard series for managing information on built assets using BIM. - [HACCP: Hazard Analysis and Critical Control Point (Codex Alimentarius)](https://securei3.com/standards/haccp.md): The internationally recognised food safety system for controlling hazards at critical points. - [ISO 22716: Cosmetics Good Manufacturing Practices](https://securei3.com/standards/iso-22716.md): Good manufacturing practice guidelines for cosmetic products, recognised by many regulators. ## Environment, energy & sustainability - [ISO 14001: Environmental management systems](https://securei3.com/standards/iso-14001.md): Manage environmental impacts and legal obligations systematically, now in its 2026 edition. - [ISO 50001: Energy management systems](https://securei3.com/standards/iso-50001.md): A structured way to cut energy use and cost, with measurable performance improvement. - [ISO 14064-1: Greenhouse gas inventories](https://securei3.com/standards/iso-14064.md): Quantify and report your organisation’s greenhouse gas emissions credibly. - [ISO 26000: Social responsibility guidance](https://securei3.com/standards/iso-26000.md): Guidance for operating in a socially responsible way across seven core subjects. - [ISO 14067: Carbon footprint of products](https://securei3.com/standards/iso-14067.md): Quantifying and communicating the carbon footprint of a product across its life cycle. - [ISO 14040 / 14044: Life cycle assessment](https://securei3.com/standards/iso-14040.md): Principles and requirements for life cycle assessment (LCA) of products and services. - [ISO 14046: Water footprint](https://securei3.com/standards/iso-14046.md): Assessing the water footprint of products, processes and organisations. - [ISO 46001: Water efficiency management systems](https://securei3.com/standards/iso-46001.md): A certifiable system for reducing water use and improving efficiency. - [ISO 20400: Sustainable procurement guidance](https://securei3.com/standards/iso-20400.md): Guidance for integrating sustainability into procurement policy and practice. - [ISO 20121: Event sustainability management systems](https://securei3.com/standards/iso-20121.md): A certifiable system for planning and running more sustainable events. - [ESG reporting (GRI, ISSB, CSRD): Sustainability reporting frameworks: GRI Standards, IFRS S1/S2 and EU CSRD/ESRS](https://securei3.com/standards/esg-reporting.md): Build ESG data and controls that support GRI, ISSB, CSRD and BRSR reporting and assurance. ## Health & safety - [ISO 45001: Occupational health and safety management systems](https://securei3.com/standards/iso-45001.md): Prevent work-related injury and ill health, with workers involved at every step. - [ISO 45003: Psychological health and safety at work](https://securei3.com/standards/iso-45003.md): Guidance on managing psychosocial risks such as workload, harassment and isolation. - [ISO 39001: Road traffic safety management systems](https://securei3.com/standards/iso-39001.md): A certifiable system to reduce deaths and serious injuries related to road traffic. ## People & HR - [ISO 30414: Human capital reporting guidelines](https://securei3.com/standards/iso-30414.md): Metrics for reporting human capital to boards, investors and regulators. - [ISO 30415: Diversity and inclusion](https://securei3.com/standards/iso-30415.md): Guidance on building and measuring diversity and inclusion across the organisation. - [ISO 30401: Knowledge management systems](https://securei3.com/standards/iso-30401.md): A certifiable system for capturing, sharing and using organisational knowledge. - [ISO 30405: Guidelines on recruitment](https://securei3.com/standards/iso-30405.md): Good practice for sourcing, screening, selecting and onboarding candidates. - [ISO 30408: Human governance guidelines](https://securei3.com/standards/iso-30408.md): Guidance on governing people-related decisions and their alignment with organisational strategy. - [ISO 30409: Workforce planning](https://securei3.com/standards/iso-30409.md): Guidance for planning workforce supply against future demand. - [ISO 30422: Learning and development](https://securei3.com/standards/iso-30422.md): Guidance for designing, delivering and evaluating workplace learning. - [ISO 23326: Employee engagement guidelines](https://securei3.com/standards/iso-23326.md): Guidance for understanding and improving employee engagement. - [ISO 10667: Assessment service delivery](https://securei3.com/standards/iso-10667.md): Requirements for assessing people in work and organisational settings. ## India regulations - [DPDP Act: India Digital Personal Data Protection Act, 2023](https://securei3.com/standards/india-dpdp.md): India’s data protection law, with its Rules phasing in core obligations by May 2027. - [RBI IT Governance Master Direction: RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices](https://securei3.com/standards/rbi-it-governance.md): RBI’s consolidated expectations on IT governance, IT risk, controls, business continuity and IS audit for regulated entities. - [RBI Cyber Security Framework: RBI Cyber Security Framework in Banks](https://securei3.com/standards/rbi-cyber-security-framework.md): The RBI baseline for cyber security policy, a cyber crisis management plan, a security operations centre and incident reporting in banks. - [RBI IT Outsourcing Master Direction: RBI Master Direction on Outsourcing of Information Technology Services](https://securei3.com/standards/rbi-it-outsourcing.md): Rules for how RBI-regulated entities select, contract, monitor and exit IT and cloud service providers. - [RBI Digital Payment Security Controls: RBI Master Direction on Digital Payment Security Controls](https://securei3.com/standards/rbi-digital-payment-security.md): Security requirements for internet banking, mobile banking, card and other digital payment channels of regulated entities. - [RBI Cyber Resilience for Payment System Operators: RBI Master Directions on Cyber Resilience and Digital Payment Security Controls for Non-bank Payment System Operators](https://securei3.com/standards/rbi-pso-cyber-resilience.md): Cyber resilience and payment security requirements for non-bank PSOs such as PPI issuers, payment aggregators and card networks. - [RBI Payment Aggregator Guidelines: RBI regulation of payment aggregators and payment gateways](https://securei3.com/standards/rbi-payment-aggregators.md): Authorisation, governance, merchant onboarding and baseline technology requirements for payment aggregators. - [RBI Payment Data Localisation: RBI directive on storage of payment system data](https://securei3.com/standards/rbi-payment-data-localisation.md): Payment system data must be stored only in India, a requirement that shapes cloud, vendor and architecture decisions. - [RBI Digital Lending Directions: RBI framework for digital lending by regulated entities and lending service providers](https://securei3.com/standards/rbi-digital-lending.md): Rules on digital loan journeys, lending service providers, data collection, disclosures and grievance redress. - [RBI KYC Master Direction: RBI Master Direction – Know Your Customer (KYC) Direction, 2016](https://securei3.com/standards/rbi-kyc-master-direction.md): Customer due diligence, beneficial ownership, risk categorisation, monitoring and reporting obligations for RBI-regulated entities. - [RBI Fraud Risk Management Directions: RBI Master Directions on Fraud Risk Management](https://securei3.com/standards/rbi-fraud-risk-management.md): Board-level fraud governance, early warning signals, fraud classification and reporting for banks and NBFCs. - [SEBI CSCRF: SEBI Cybersecurity and Cyber Resilience Framework](https://securei3.com/standards/sebi-cscrf.md): SEBI’s unified cyber framework for regulated entities, scaled by category, with goals to anticipate, withstand, contain, recover and evolve. - [SEBI Cloud Framework: SEBI framework for adoption of cloud services by regulated entities](https://securei3.com/standards/sebi-cloud-framework.md): Governance, data localisation, security, audit and exit requirements for SEBI-regulated entities using cloud. - [IRDAI Cyber Security Guidelines: IRDAI Information and Cyber Security Guidelines, 2023](https://securei3.com/standards/irdai-cyber-guidelines.md): Information and cyber security requirements for insurers, intermediaries and other IRDAI-regulated entities. - [CERT-In Directions: CERT-In Directions under Section 70B(6) of the IT Act (April 2022)](https://securei3.com/standards/cert-in-directions.md): Six-hour cyber incident reporting, 180-day log retention and clock synchronisation for organisations in India. - [IT Act & SPDI Rules: Information Technology Act, 2000 and Reasonable Security Practices (SPDI) Rules, 2011](https://securei3.com/standards/india-it-act.md): India’s foundational cyber law, including security practices for sensitive personal data as the DPDP regime phases in. - [PMLA: Prevention of Money-laundering Act, 2002 and PML Rules](https://securei3.com/standards/india-pmla.md): India’s anti-money laundering law: reporting entities must verify clients, maintain records and report to FIU-IND. - [Internal Financial Controls (Companies Act): Internal financial controls under the Companies Act, 2013](https://securei3.com/standards/india-ifc.md): Directors and auditors must report on the adequacy and operating effectiveness of internal financial controls. - [SEBI BRSR: SEBI Business Responsibility and Sustainability Reporting (including BRSR Core)](https://securei3.com/standards/india-brsr.md): Mandatory ESG disclosure for India’s largest listed companies, with assurance of BRSR Core indicators phasing in. - [Telecom Cyber Security Rules: Telecommunications Act, 2023 and Telecom Cyber Security Rules, 2024](https://securei3.com/standards/india-telecom-cyber.md): Cyber security obligations for telecom entities, including security policies, CTSO appointment and incident reporting. - [CEA Power Sector Cyber Guidelines: Central Electricity Authority (Cyber Security in Power Sector) Guidelines](https://securei3.com/standards/cea-power-cyber.md): Cyber security requirements for generation, transmission and distribution utilities, including OT environments. - [NABH Accreditation: National Accreditation Board for Hospitals & Healthcare Providers standards](https://securei3.com/standards/nabh-accreditation.md): India’s accreditation for hospitals and healthcare providers, focused on patient safety and quality of care. - [POSH Act: Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013](https://securei3.com/standards/india-posh.md): Every employer with ten or more employees must have an Internal Committee, a policy and an annual compliance cycle. - [India Labour Codes: India’s four labour codes on wages, industrial relations, social security and occupational safety](https://securei3.com/standards/india-labour-codes.md): Consolidated labour law across wages, industrial relations, social security and workplace safety, now in force. - [Aadhaar (UIDAI) compliance: Aadhaar Act, 2016 and UIDAI authentication regulations for AUAs and KUAs](https://securei3.com/standards/uidai-aadhaar.md): Security and audit obligations for organisations using Aadhaar authentication and e-KYC. - [MeitY cloud empanelment: MeitY empanelment of cloud service offerings for government](https://securei3.com/standards/meity-cloud-empanelment.md): Empanelment that allows cloud service providers to host Indian government workloads. - [GIGW & STQC website audit: Guidelines for Indian Government Websites and Apps (GIGW 3.0) and STQC certification](https://securei3.com/standards/gigw-stqc.md): Quality, accessibility and security requirements for government websites and apps. - [E-commerce & consumer protection rules: Consumer Protection (E-Commerce) Rules, 2020 and dark pattern guidelines](https://securei3.com/standards/india-ecommerce-rules.md): Disclosure, grievance and fair-practice duties for e-commerce platforms and sellers in India. ## GCC regulations - [UAE PDPL: UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021)](https://securei3.com/standards/uae-pdpl.md): The UAE’s federal data protection law for organisations processing personal data in or from the UAE. - [KSA PDPL: Saudi Arabia Personal Data Protection Law](https://securei3.com/standards/ksa-pdpl.md): Saudi Arabia’s data protection law, fully enforceable since September 2024 and supervised by SDAIA. - [NCA ECC: Saudi National Cybersecurity Authority Essential Cybersecurity Controls](https://securei3.com/standards/nca-ecc.md): Mandatory baseline cybersecurity controls for Saudi government entities and critical infrastructure operators. - [SAMA CSF: Saudi Central Bank Cyber Security Framework](https://securei3.com/standards/sama-csf.md): The cyber security framework for banks, insurers and finance companies regulated by the Saudi Central Bank. - [UAE IA Standard: UAE Information Assurance Regulation (TDRA)](https://securei3.com/standards/uae-ia-standard.md): The UAE’s national information assurance controls for government entities and critical sectors. - [CST Cloud Class A, B, C: CST Cloud Computing Regulatory Framework and cloud provider registration](https://securei3.com/standards/cst-ccrf.md): Registration and classification of cloud service providers in Saudi Arabia, from Qualifying to Class C, which decides the data and sectors you can serve. - [Dubai ISR: Dubai Information Security Regulation (Dubai Electronic Security Center)](https://securei3.com/standards/dubai-isr.md): Dubai’s information security regulation for government entities and critical sectors in the emirate. - [ADHICS: Abu Dhabi Healthcare Information and Cyber Security Standard (DoH)](https://securei3.com/standards/adhics.md): Mandatory information and cyber security standard for healthcare entities licensed by the Abu Dhabi Department of Health. - [CBUAE Requirements: Central Bank of the UAE regulations for licensed financial institutions](https://securei3.com/standards/cbuae-regulations.md): Outsourcing, business continuity, consumer protection and operational risk expectations for UAE-licensed financial institutions. - [NCA CSCC: NCA Critical Systems Cybersecurity Controls](https://securei3.com/standards/nca-cscc.md): Additional cybersecurity controls for critical systems inside national critical entities in Saudi Arabia, building on the ECC. - [UAE AML/CFT: UAE anti-money laundering and counter-terrorist financing framework](https://securei3.com/standards/uae-aml.md): AML/CFT obligations for UAE financial institutions and designated non-financial businesses, including goAML reporting. - [DIFC & ADGM Data Protection: DIFC Data Protection Law No. 5 of 2020 and ADGM Data Protection Regulations 2021](https://securei3.com/standards/difc-adgm-data-protection.md): GDPR-aligned data protection laws for firms in the UAE’s financial free zones. - [NCA TCC: NCA Telework Cybersecurity Controls](https://securei3.com/standards/nca-tcc.md): Saudi cybersecurity controls for remote and hybrid working, covering devices, connections, access and monitoring. - [NCA CCC: NCA Cloud Cybersecurity Controls](https://securei3.com/standards/nca-ccc.md): Saudi cloud cybersecurity controls for cloud service providers and organisations using cloud services. - [NCA DCC: NCA Data Cybersecurity Controls](https://securei3.com/standards/nca-dcc.md): Saudi controls for protecting data according to its classification throughout its life cycle. - [NCA OSMACC: NCA Organisations’ Social Media Accounts Cybersecurity Controls](https://securei3.com/standards/nca-osmacc.md): Saudi controls for securing official organisational social media accounts against takeover, leaks and impersonation. - [NCA OTCC: NCA Operational Technology Cybersecurity Controls](https://securei3.com/standards/nca-otcc.md): Saudi cybersecurity controls for industrial control systems and operational technology. - [SAMA BCM Framework: Saudi Central Bank Business Continuity Management Framework](https://securei3.com/standards/sama-bcm.md): Business continuity requirements for banks, insurers and finance companies regulated by SAMA. - [SAMA Counter-Fraud Framework: Saudi Central Bank Counter-Fraud Framework](https://securei3.com/standards/sama-counter-fraud.md): Fraud governance, prevention, detection and response requirements for SAMA-regulated institutions. - [KSA AML/CTF: Saudi Arabia anti-money laundering and counter-terrorism financing laws](https://securei3.com/standards/ksa-aml.md): AML/CTF obligations for Saudi financial institutions and designated non-financial businesses and professions. - [NDMO Data Standards: NDMO Data Management and Personal Data Protection Standards (SDAIA)](https://securei3.com/standards/ndmo-data-standards.md): SDAIA’s national standards for data governance, classification, quality, sharing and personal data protection across 14 domains. - [SDAIA AI Ethics Principles: Saudi Data & AI Authority AI Ethics Principles](https://securei3.com/standards/sdaia-ai-ethics.md): Saudi Arabia’s national principles for developing and using AI responsibly. - [Qatar NIA: Qatar National Information Assurance Policy and Standard](https://securei3.com/standards/qatar-nia.md): Qatar’s national information assurance framework for government and critical sectors. - [Qatar PDPPL: Qatar Personal Data Privacy Protection Law (Law No. 13 of 2016)](https://securei3.com/standards/qatar-pdppl.md): Qatar’s data protection law, one of the first in the GCC. - [Bahrain PDPL: Bahrain Personal Data Protection Law (Law No. 30 of 2018)](https://securei3.com/standards/bahrain-pdpl.md): Bahrain’s data protection law, supervised by the Personal Data Protection Authority. - [Oman PDPL: Oman Personal Data Protection Law (Royal Decree 6/2022)](https://securei3.com/standards/oman-pdpl.md): Oman’s data protection law with its executive regulations. - [SAMA ITGF: SAMA Information Technology Governance Framework](https://securei3.com/standards/sama-itgf.md): The Saudi Central Bank’s framework for IT governance, IT risk and IT operations in regulated financial institutions. - [DESC CSP Standard: Dubai Electronic Security Center Cloud Service Provider Security Standard](https://securei3.com/standards/desc-csp.md): Mandatory security certification for cloud providers serving Dubai government and semi-government entities. - [UAE ICT Health Law: UAE Federal Law No. 2 of 2019 on the use of ICT in health fields](https://securei3.com/standards/uae-ict-health-law.md): UAE federal rules for health data: confidentiality, retention, data location and the use of technology in healthcare. - [VARA Rulebooks: Dubai Virtual Assets Regulatory Authority regulations and rulebooks](https://securei3.com/standards/vara-rulebooks.md): Dubai’s licensing and conduct rules for virtual asset service providers, including technology, compliance and risk management rulebooks. ## Global & regional laws - [GDPR: EU General Data Protection Regulation](https://securei3.com/standards/gdpr.md): The EU’s data protection law, which applies to anyone offering goods or services to, or monitoring, people in the EU. - [DORA: EU Digital Operational Resilience Act](https://securei3.com/standards/dora.md): EU regulation on ICT risk and operational resilience for financial entities and their critical ICT providers, applying since January 2025. - [NIS2: EU Network and Information Security Directive](https://securei3.com/standards/nis2.md): The EU’s cybersecurity directive for essential and important entities across 18 sectors. - [EU AI Act: EU Artificial Intelligence Act](https://securei3.com/standards/eu-ai-act.md): The EU’s risk-based AI law, with obligations phasing in from 2025 and high-risk rules now expected from late 2027. - [HIPAA: US Health Insurance Portability and Accountability Act](https://securei3.com/standards/hipaa.md): US rules protecting health information, applying to covered entities and their business associates. - [UK GDPR: UK GDPR and Data Protection Act 2018](https://securei3.com/standards/uk-gdpr.md): The UK’s data protection regime, closely based on the EU GDPR. - [CCPA / CPRA: California Consumer Privacy Act as amended by the CPRA](https://securei3.com/standards/ccpa-cpra.md): California’s consumer privacy law, the most influential US state privacy law. - [Singapore PDPA: Singapore Personal Data Protection Act 2012](https://securei3.com/standards/singapore-pdpa.md): Singapore’s data protection law, including mandatory breach notification. - [EU Cyber Resilience Act: EU Cyber Resilience Act (Regulation (EU) 2024/2847)](https://securei3.com/standards/eu-cyber-resilience-act.md): Cybersecurity requirements for products with digital elements sold in the EU. - [SOX: US Sarbanes-Oxley Act (Sections 302 and 404)](https://securei3.com/standards/sox.md): Internal control over financial reporting requirements for companies listed in the US. - [EU AML Package: EU Anti-Money Laundering Regulation, 6th AML Directive and AMLA](https://securei3.com/standards/eu-amlr.md): The EU’s single AML rulebook and new supervisory authority, phasing in through 2027. ## Services - [Gap assessment](https://securei3.com/services/gap-assessment.md): Know exactly where you stand against a standard or law, and what it will take to close the gaps. - [Implementation](https://securei3.com/services/implementation.md): Hands-on help building a management system that works in practice and passes the audit. - [Documentation support](https://securei3.com/services/documentation-support.md): Lean, audit-ready policies, procedures and records, written for your organisation, not copied from a template. - [Internal audit](https://securei3.com/services/internal-audit.md): Independent internal audits that find real improvements and satisfy certification requirements. - [Certification audit support](https://securei3.com/services/certification-audit-support.md): Get through Stage 1 and Stage 2 smoothly, with the right certification body for your market. - [SOC & ISAE attestation support](https://securei3.com/services/soc-attestation-support.md): SOC 1, SOC 2, SOC 3, ISAE 3402 and ISAE 3000 reports, from readiness to the final report through our partner CPA and audit firms. - [Standard transition support](https://securei3.com/services/transition-support.md): Move your certificate to the new edition of ISO 9001, ISO 14001, ISO 37001, ISO/IEC 27701 and others, well before the deadline. - [Regulatory compliance](https://securei3.com/services/regulatory-compliance.md): Compliance with local and international laws, data protection, cybersecurity and sector regulations. - [VAPT & penetration testing](https://securei3.com/services/vapt-penetration-testing.md): Vulnerability assessment and penetration testing for applications, networks, cloud and APIs, with reports your customers and auditors accept. - [Training & workshops](https://securei3.com/services/training-and-workshops.md): Public and in-house courses, leadership briefings and practical workshops on ISO, privacy, AI and cybersecurity. - [Compliance awareness programmes](https://securei3.com/services/compliance-awareness-programmes.md): An annual awareness programme for every employee, planned, run and reported for you, with completion records ready for auditors. - [Integrated management systems](https://securei3.com/services/integrated-management-systems.md): Combine ISO 9001, 14001, 45001, 27001 and more into one efficient system with shared processes. - [Managed compliance services](https://securei3.com/services/managed-compliance.md): Ongoing compliance management, a virtual compliance team that keeps you certified and audit-ready all year. ## Platforms - [Secure iQube Learn](https://securei3.com/platforms/learn.md): Self-paced, interactive e-learning on ISO standards, information security, privacy, ethics and a safe workplace, with training certificates, a client dashboard and SCORM packages for your own LMS. - [Secure iQube Compliance](https://securei3.com/platforms/compliance.md): One integrated workspace for ISO management systems, SOC 2, privacy laws, ESG reporting and supplier risk: discovery, controls, policies, risks, audits and actions in plan, do, check, act order. ## Industries - [Technology, SaaS & IT services](https://securei3.com/industries/technology-saas.md): Security and AI assurance that removes friction from enterprise sales. - [Banking, fintech & financial services](https://securei3.com/industries/banking-financial-services.md): Resilience, cybersecurity and vendor assurance for regulated finance. - [Healthcare & life sciences](https://securei3.com/industries/healthcare-life-sciences.md): Protect patient data and meet quality obligations across care and medical technology. - [Manufacturing & automotive](https://securei3.com/industries/manufacturing-automotive.md): Quality, environment and safety systems that hold up on the shop floor. - [Energy, oil & gas](https://securei3.com/industries/energy-oil-gas.md): Safety, environmental and cybersecurity discipline for high-hazard operations. - [Government & public sector](https://securei3.com/industries/government-public-sector.md): Governance, security and service quality for public bodies and their suppliers. - [BPO, KPO & professional services](https://securei3.com/industries/bpo-professional-services.md): Client-ready assurance for organisations that process other companies’ data. ## Training courses - [ISO/IEC 27001 Awareness](https://securei3.com/training/iso-27001-awareness.md): Awareness, 1 day. Understand what ISO 27001 requires and your role in an ISMS. - [ISO/IEC 27001 Lead Implementer](https://securei3.com/training/iso-27001-lead-implementer.md): Implementer, 5 days. Plan, build and run an ISMS from scope to certification. - [ISO/IEC 27001 Internal Auditor](https://securei3.com/training/iso-27001-internal-auditor.md): Internal auditor, 2 days. Plan and conduct effective internal ISMS audits. - [ISO/IEC 27001 Lead Auditor](https://securei3.com/training/iso-27001-lead-auditor.md): Lead auditor, 5 days. Lead ISMS audits to certification-body standard. - [ISO/IEC 42001 Lead Implementer](https://securei3.com/training/iso-42001-lead-implementer.md): Implementer, 5 days. Plan, build and run an AI management system, including AI risk and impact assessment. - [ISO/IEC 42001 Internal Auditor](https://securei3.com/training/iso-42001-internal-auditor.md): Internal auditor, 2 days. Audit AI governance and controls with confidence. - [ISO/IEC 27701:2025 Privacy Implementer](https://securei3.com/training/iso-27701-implementer.md): Implementer, 3 days. Implement a privacy information management system aligned with global privacy laws. - [ISO/IEC 42001 Lead Auditor](https://securei3.com/training/iso-42001-lead-auditor.md): Lead auditor, 5 days. Lead audits of AI management systems to certification-body standard. - [ISO 9001:2026 Transition Workshop](https://securei3.com/training/iso-9001-2026-transition.md): Workshop, 1 day. What changed in ISO 9001:2026 and how to transition smoothly. - [ISO 9001 Internal Auditor](https://securei3.com/training/iso-9001-internal-auditor.md): Internal auditor, 2 days. Plan and conduct internal quality audits that drive improvement. - [ISO 9001 Lead Auditor](https://securei3.com/training/iso-9001-lead-auditor.md): Lead auditor, 5 days. Lead quality management system audits, updated for ISO 9001:2026. - [ISO 14001:2026 Internal Auditor](https://securei3.com/training/iso-14001-internal-auditor.md): Internal auditor, 2 days. Audit environmental management systems under the 2026 edition. - [ISO 45001 Internal Auditor](https://securei3.com/training/iso-45001-internal-auditor.md): Internal auditor, 2 days. Audit OH&S management systems and worker participation. - [ISO 22301 Business Continuity Implementer](https://securei3.com/training/iso-22301-implementer.md): Implementer, 3 days. Run a business impact analysis and build tested continuity plans. - [SOC 2 Readiness Workshop](https://securei3.com/training/soc-2-readiness-workshop.md): Workshop, 1 day. Understand the SOC 2 process and plan a realistic path to your first report. - [India DPDP Act & Rules Workshop](https://securei3.com/training/dpdp-act-workshop.md): Workshop, 1 day. Prepare for DPDP obligations before they apply in May 2027. - [Security & Privacy Awareness for Employees](https://securei3.com/training/security-awareness.md): Awareness, 2 hours. Engaging awareness training that meets ISO 27001 and privacy law requirements. - [RBI IT Governance & Cyber Compliance Workshop](https://securei3.com/training/rbi-it-governance-workshop.md): Workshop, 1 day. What the RBI IT Governance Master Direction and cyber framework expect, and how to evidence it. - [AML, KYC & Sanctions Training](https://securei3.com/training/aml-kyc-training.md): Awareness, ½ day. Practical AML/CFT, KYC and sanctions training for front-line and operations staff. - [Fraud Risk Management Workshop](https://securei3.com/training/fraud-risk-workshop.md): Workshop, 1 day. Run a fraud risk assessment and design controls that prevent and detect fraud. - [POSH Internal Committee Training](https://securei3.com/training/posh-internal-committee.md): Workshop, 1 day. Equip Internal Committee members to run fair, lawful POSH inquiries. - [ISO 37001 Anti-Bribery Implementer](https://securei3.com/training/iso-37001-implementer.md): Implementer, 3 days. Build an anti-bribery management system that withstands scrutiny. - [ISO 30414 Human Capital Reporting Workshop](https://securei3.com/training/human-capital-reporting.md): Workshop, 1 day. Choose and report the people metrics boards and investors want. - [ISO 14001:2026 Transition Workshop](https://securei3.com/training/iso-14001-2026-transition.md): Workshop, 1 day. What changed in ISO 14001:2026 and how to transition before 30 April 2029. - [ISO 37001:2025 Transition Briefing](https://securei3.com/training/iso-37001-2025-transition.md): Workshop, ½ day. Get ready for the 28 February 2027 deadline for ISO 37001:2016 certificates. - [ISO/IEC 27701:2025 Transition Workshop](https://securei3.com/training/iso-27701-2025-transition.md): Workshop, 1 day. Move your privacy certification from the 2019 extension to the standalone 2025 edition. ## Insights - [How long does ISO/IEC 42001 certification take?](https://securei3.com/insights/how-long-does-iso-42001-certification-take.md): A realistic timeline for ISO/IEC 42001 AI management system certification: the phases, what each involves, what speeds it up or slows it down, and how an existing ISO/IEC 27001 system helps. - [NCA cybersecurity controls for the private sector: who is in scope and how to prepare](https://securei3.com/insights/nca-cybersecurity-controls-private-sector.md): Saudi Arabia's NCA has issued cybersecurity controls for private sector entities outside critical national infrastructure. Who is in scope, what the controls cover, and a practical way to prepare. - [Compliance awareness training: what auditors look for and how to deliver it](https://securei3.com/insights/compliance-awareness-training-evidence.md): What ISO 27001, ISO 9001, ISO 37001, privacy laws and India's POSH Act expect from awareness training, what evidence auditors ask for, and how to choose between hosted e-learning and SCORM in your own LMS. - [One control, many standards: running several ISO standards and laws as one system](https://securei3.com/insights/one-control-many-standards.md): How to run ISO 27001, ISO 9001, ISO 27701, SOC 2 and privacy laws such as DPDP and GDPR as one integrated management system, with one control set, one risk method and one audit programme. - [Beyond ISO 9001 and 27001: the ISO 37000 governance and ISO 30400 HR series explained](https://securei3.com/insights/iso-37000-and-30400-series-explained.md): What the ISO 37000 governance family (37000, 37001, 37002, 37008, 37301) and ISO 30400 HR family (30401, 30405, 30414, 30415, 30422) cover, and which are certifiable. - [RBI, SEBI, IRDAI and CERT-In: a map of India’s financial-sector cyber rules](https://securei3.com/insights/india-financial-sector-cyber-regulations.md): Which Indian cyber and IT rules apply to banks, NBFCs, payment companies, brokers and insurers: and how to meet them with one control framework. - [DPDP Rules 2025: the compliance timeline every organisation serving India should know](https://securei3.com/insights/dpdp-rules-2025-timeline.md): The DPDP Rules were notified on 13 November 2025. Here is what applies when: November 2026 and May 2027, and how to prepare. - [ISO 9001:2026 is published: what changed and how to transition](https://securei3.com/insights/iso-9001-2026-whats-changed.md): ISO 9001:2026 was published in September 2026. Here are the key changes: quality culture, risk, change management, knowledge and climate, and a practical transition plan. - [ISO 27001 vs SOC 2: which do you need, and can you get both?](https://securei3.com/insights/iso-27001-vs-soc-2.md): A plain-language comparison of ISO/IEC 27001 certification and SOC 2 attestation: scope, cost drivers, timelines, who asks for each, and how to reuse work across both. - [ISO 14001:2026: what the new edition means for certified organisations](https://securei3.com/insights/iso-14001-2026-transition.md): ISO 14001:2026 was published in April 2026. Learn what changed: environmental conditions, life cycle perspective, change management, and how to transition before 2029. - [What is ISO/IEC 42001? A practical guide to AI management system certification](https://securei3.com/insights/what-is-iso-42001.md): ISO/IEC 42001 explained: who needs it, what it requires, how it links to the EU AI Act, and the steps and timeline to certification. - [ISO consultant or certification body? How to choose: and why you need to keep them separate](https://securei3.com/insights/consultant-vs-certification-body.md): The difference between ISO consultants and accredited certification bodies such as BSI, DNV, TÜV, LRQA, Intertek and SGS, and how to choose each. ## Optional - [About Secure iQube](https://securei3.com/about.md) - [Standard finder tool](https://securei3.com/standard-finder/): interactive shortlist of standards and regulations based on industry, customer and regulator requirements, and markets - [Privacy policy](https://securei3.com/privacy-policy/)