The Algorithm / Site Directory / Knowledge Base

Knowledge Base Directory

225 compliance frameworks and regulations, organized by category. Phase 2 consolidated 3,124 templated industry variants into these substantive source pages.

Healthcare Regulation

21st Century Cures Act

ONC Interoperability Rule

Mental Health Parity and Addiction Equity Act

CMS Conditions of Participation

CMS Prior Authorization API Rule

Information Blocking Prohibition

Privacy & Data Protection

GDPR Article 25 — Privacy by Design and by Default

GDPR Article 35 — Data Protection Impact Assessment (DPIA)

Schrems II, Standard Contractual Clauses, and Cross-Border Data Transfers

EU-US Data Privacy Framework (2023)

ePrivacy Directive and Cookie Consent Requirements

GDPR Article 17 — Right to Erasure (Right to be Forgotten)

GDPR Article 20 — Right to Data Portability

PIPL (China Personal Information Protection Law)

India Digital Personal Data Protection Act 2023

GDPR Legitimate Interests (Article 6(1)(f))

GDPR Consent — Technical Requirements

GDPR Data Protection Officer (DPO)

GDPR Data Controller vs. Processor

Compliance Frameworks

ISO 22301 (Business Continuity Management)

ISO 31000 (Risk Management)

SOC 1 Type II (Internal Controls over Financial Reporting)

NIST Privacy Framework 1.0

NIST SP 800-63 (Digital Identity Guidelines) — IAL, AAL, FAL Levels

NIST SP 800-37 (Risk Management Framework for Information Systems)

Third-Party Risk Management (TPRM) Frameworks

Government & Defense

ITAR (International Traffic in Arms Regulations)

EAR (Export Administration Regulations)

DFARS (Defense Federal Acquisition Regulation Supplement)

NIST SP 800-171 (Protecting CUI in Non-Federal Systems)

CUI (Controlled Unclassified Information) Program

NIST SP 800-207 (Zero Trust Architecture)

DISA STIG (Security Technical Implementation Guides)

RMF and the ATO Process

FedRAMP High vs. Moderate and DoD IL4/IL5

Executive Order 14028 on Improving the Nation's Cybersecurity

SBOM (Software Bill of Materials)

NIST SP 800-218 (Secure Software Development Framework — SSDF)

Supply Chain Risk Management (SCRM) Frameworks

FAR Cybersecurity Clauses for Government Contractors

Section 889 of the NDAA (Huawei/ZTE Equipment Ban)

Healthcare Interoperability

Medical Device Regulation

FDA SaMD Classification

Medical Device Standard

Healthcare Quality

CMS Star Ratings

Healthcare Privacy Engineering

HIPAA De-Identification Standards

Financial Services Regulation

CCAR and DFAST Stress Testing

FFIEC IT Examination Handbook

FINRA Regulations

PSD2 and Open Banking

IFRS 9 and CECL

Energy & Infrastructure

IEC 62443 (Industrial Automation and Control Systems Security)

TSA Pipeline Security Directives (2021–2022)

NIST IR 7628 Smart Grid Cybersecurity Guidelines

NRC 10 CFR 73.54 Nuclear Cybersecurity Requirements

SCADA/ICS/OT Security Standards and Frameworks

OT/IT Convergence Security Architecture

Privacy Law

Virginia Consumer Data Protection Act (VCDPA)

Colorado Privacy Act (CPA)

Connecticut Data Privacy Act (CTDPA)

Texas Data Privacy and Security Act (TDPSA)

Washington My Health My Data Act (MHMDA)

Brazil LGPD (Lei Geral de Proteção de Dados) — Engineering Specifics

Singapore PDPA and Mandatory Breach Notification

Japan APPI (Act on the Protection of Personal Information) 2022 Amendments

Australia Privacy Act 2023–2024 Reform Proposals

ISO 27701 (Privacy Information Management — Extension to ISO 27001)

Consent Management Platforms (CMPs) and Technical Requirements

Data Minimization as an Engineering Principle (GDPR Art. 5)

Cloud Security

ISO 27017 (Cloud Security Controls)

ISO 27018 (Protection of PII in Public Clouds)

CSA STAR (Cloud Security Alliance Security, Trust, Assurance, and Risk)

Security by Design Principles and Implementation

Shift-Left Security in CI/CD Pipelines

CASB (Cloud Access Security Broker) in Regulated Cloud Environments

AI Governance

ISO 42001 (AI Management System Standard)

OWASP LLM Top 10 (2025 Version)

Model Cards and AI Transparency Requirements

Algorithmic Accountability Act Proposals and Requirements

Explainable AI (XAI) Requirements in Regulated Sectors

AI Bias Auditing Requirements Under EU AI Act and State Laws

Telecom Compliance

FCC Part 64 CPNI (Customer Proprietary Network Information)

CALEA (Communications Assistance for Law Enforcement Act)

Financial & Retail Compliance

FTC Red Flags Rule (Identity Theft Prevention)

Payment Security

PCI DSS v4.0 New Requirements

PCI PIN Security Standard

IT Service Management

ISO 55001 (Asset Management)

ITIL 4 Framework (IT Service Management)

ISO 20000 (IT Service Management Systems)

Disaster Recovery (RPO/RTO) in Regulated Industries

IT Governance

COBIT 2019 (Governance and Management of Enterprise IT)

Change Management Processes for Regulated Systems (ITIL, SOX)

DevOps & Pipeline Security

GitOps Security and Pipeline Integrity

Container Security (CIS Benchmarks, Runtime Security)

Kubernetes Security Standards and Hardening

OpenTelemetry and Observability-as-Code for Compliance

Service Mesh Security (Istio, Linkerd) in Regulated Environments

CNCF Cloud Native Security Whitepaper

Policy as Code (OPA, Sentinel) for Automated Compliance

Architecture Patterns

Event Sourcing as a Compliance Architecture Pattern

CQRS (Command Query Responsibility Segregation) for Audit Trails

Saga Pattern for Distributed Transaction Compliance

Domain-Driven Design (DDD) for Regulatory Boundaries

Hexagonal Architecture (Ports and Adapters) for Testable Compliance

Immutable Infrastructure for Auditability

Security Architecture

Secrets Management (Vault, AWS Secrets Manager) Patterns

Encryption at Rest — Architecture Patterns for Regulated Data

Encryption in Transit — TLS 1.3 and Certificate Management

Key Management (KMS) Architecture for Regulated Systems

IAM (Identity and Access Management) Architecture

PAM (Privileged Access Management) for Regulated Environments

Audit Logging Architecture for Compliance Evidence

Financial Regulation

Basel III Liquidity Coverage Ratio (LCR) and NSFR Engineering Requirements

MiFIR Transaction Reporting and Best Execution Data Requirements

CSDR Settlement Discipline and Central Securities Depositories Regulation

SFDR (Sustainable Finance Disclosure Regulation) Technical Implementation

Regulatory Compliance

ESMA Guidelines on Outsourcing to Cloud Service Providers

EBA Guidelines on ICT and Security Risk Management

Security Frameworks

NIST CSF 2.0 — What Changed from 1.1 and Engineering Implications

CIS Controls v8 Implementation Groups and Regulated Industry Application

MITRE ATT&CK Framework for Regulated Industry Threat Modeling

Security Engineering

STRIDE Threat Modeling Methodology for Regulated Systems

Application Security

OWASP Top 10 (2021) for Regulated Industry Applications

OWASP API Security Top 10 (2023) for Financial and Health APIs

Security Testing

Penetration Testing Requirements in Regulated Environments

Security Operations

Vulnerability Management Programs for Regulated Systems

Incident Response Planning and Mandatory Notification Timelines

Digital Forensics and Evidence Preservation for Regulatory Investigations

Log Management Architecture and Retention for Compliance

SIEM (Security Information and Event Management) for Compliance Monitoring

EDR/XDR Endpoint Detection in Regulated Environments

Patch Management Programs in Regulated Environments

Data Security

DLP (Data Loss Prevention) Technical Controls for Regulated Data

Network Security

Network Segmentation and Micro-Segmentation for Compliance

Operational Resilience

DDoS Protection Requirements Under DORA, FFIEC, and NHS Standards

Infrastructure Engineering

Capacity Planning and Scaling for Regulated Workloads

Quality Engineering

Performance Testing and SLA Compliance in Regulated Systems

API Engineering

API Rate Limiting and Throttling for Financial and Health APIs

Webhook Security for Regulated Data Integrations

Data Governance

Data Lineage and Provenance Tracking for Regulatory Compliance

Healthcare Compliance

HIPAA Omnibus Rule

Meaningful Use / Promoting Interoperability

NIST SP 800-66 Rev 2

ICD-10 Coding and Clinical Data Standardization

DICOM (Digital Imaging and Communications in Medicine)

X12 EDI Healthcare Transactions

CPCDS (Common Payer Consumer Data Set)

SMART on FHIR Authorization Framework

Quality & Standards

ISO 9001:2015 Quality Management Systems

Security Standards

ISO/IEC 27005 Information Security Risk Management

NIST SP 800-53 Rev 5 Control Families

Compliance Engineering

Continuous Compliance

Compliance as Code

GitOps Compliance Workflows

Infrastructure Drift Detection and Remediation

Chaos Engineering for Compliance Validation

Multi-Cloud Compliance Architecture

Healthcare Informatics

ICD-10/ICD-11 Medical Coding

Healthcare Regulatory

MACRA/MIPS Quality Reporting

Meaningful Use / Promoting Interoperability

340B Drug Pricing Program

Prior Authorization API (CMS-0057)

CMS Quality Measures

Financial Regulatory

FATF Anti-Money Laundering Standards

KYC/AML Compliance Engineering

SEC Rule 17a-4 (WORM Storage)

IFRS 9 Financial Instruments

BCBS 239 Risk Data Aggregation

Information Security

ISO 27001 Information Security

ISO 27701 Privacy Information Management

NIST Privacy Framework

Data Engineering

Master Data Management (MDM)

Data Quality Engineering

Cybersecurity

Threat Modeling (STRIDE)

CVE/CVSS Vulnerability Scoring

XDR/MDR Security Operations

SOAR (Security Orchestration, Automation, Response)

Architecture

Domain-Driven Design (DDD)

Hexagonal Architecture (Ports & Adapters)

Database Sharding

AWS Well-Architected Framework

Multi-Cloud Governance

Serverless Compliance Architecture

FinOps Maturity Model

Security

Quantum-Safe / Post-Quantum Cryptography

Homomorphic Encryption

Confidential Computing

Kubernetes Security (CIS Benchmarks, PSA)

Infrastructure as Code (IaC) Security

Vulnerability Management Program

Penetration Testing for Regulated Industries

Software Supply Chain Security

Bug Bounty Programs

Emerging Tech

MLOps (Machine Learning Operations)

Responsible AI Governance

Compliance

NERC CIP (Critical Infrastructure Protection)

IEC 62443 Industrial Control System Security

NIS2 Directive (EU Network and Information Security)

ENISA Cybersecurity Guidelines