Four markets

The law around the governance work, in market order

The standard is guidance. The obligations around it are not. For each market the frameworks were chosen by a scan of the library, not from a fixed list. The order is the United States, the European Union, the United Kingdom and Australia. Where the library does not cover a market regime, the page names it and does not state its duties.

The scan used the buyer activity and data: information security governance, ISMS, board risk oversight, management accountability and incident reporting. The chosen frameworks are the ones that genuinely apply to this buyer, not every framework that mentions security.

United States

The federal framework is the primary reference for a US governance programme. The disclosure rules are named as a reporting context, not stated as a duty of this standard.

Framework in the library	Why it matters to this buyer
NIST Cybersecurity Framework 2.0	The voluntary federal framework. Its govern function covers the board oversight, roles and risk appetite that the governance clauses describe.
NIST SP 800-53 Revision 5	The control catalogue many US programmes adopt. Its planning, risk assessment and audit controls support the evidence a board asks for.
SEC cybersecurity disclosure rule	The disclosure regime for public companies. It makes governance, strategy and incident reporting a board and investor matter.

European Union

NIS2 is the sector law most directly aimed at management body accountability. DORA applies in financial services, and the GDPR is the data baseline for the information the governance covers.

Framework in the library	Why it matters to this buyer
NIS2 Directive (EU) 2022/2555	The network and information security regime. It places management body accountability and training duties on essential and important entities.
GDPR, Regulation (EU) 2016/679	The data protection baseline. Accountability, records of processing and breach reporting all bear on the governance record.
DORA, Regulation (EU) 2022/2554	The digital operational resilience regime for financial entities. Its management body duties and reporting lines are close to the governance cycle.

United Kingdom

The governance code sets the board context, and the data protection law sets the duties for the information most likely to be in scope.

Framework in the library	Why it matters to this buyer
UK GDPR	The retained data protection regulation. It governs the personal data and the accountability the board has to oversee.
UK Data Protection Act 2018	The act that supplements the UK GDPR. It carries the exemptions and the enforcement framework.
FCA and PRA operational resilience framework	The UK operational resilience regime. Its governance, impact tolerance and incident duties shape what a board is expected to oversee.

Australia

CPS 234 is the closest sector duty for a regulated entity, and the privacy law sets the data context around it.

Framework in the library	Why it matters to this buyer
Privacy Act 1988 (Cth)	The federal privacy act. It governs the personal information the entity holds and the accountability for it.
Australian Privacy Principles	The principles that operationalise the Privacy Act, including notice, use and disclosure and access.
APRA Prudential Standard CPS 234	The information security standard for APRA-regulated entities. It places board accountability and incident notification duties on the entity.

How to read this page. The standard gives the governance model. These frameworks give the legal and regulatory context. A clause answer on this site is not a statement of any of these laws. Read the framework page before relying on a duty.

THE RULES THIS IS BUILT FROM

Read from the real rules, not invented

Every clause answer on this site points to the official rule behind it, so you can check any line yourself. The register holds 28 records, 110 evidence lines and 84 common failure lines. The dates come from the ISO record. The substance comes from the published 2020 edition, which is the baseline that edition 3 replaces.

25 CLAUSES

One page per clause

The duty in our words, the evidence a board or an auditor asks for, the common gaps and what to do before publication.

Open the register

3 ANNEXES

Guidance, clearly labelled

Annexes A to C are informative. Each page says so, because a finding cannot rest on guidance alone.

Open the annexes

ONE STAGE RECORD

No invented date

Stage 50.60 is recorded on 12 August 2026. The planning date is an estimate and is labelled wherever it appears.

Read the record

The edition 3 text is not public and is not reproduced. Each record cites the published clause it comes from. Where the public record is silent, the page says so.