Awesome Compliance ✅

A curated list of awesome tools, frameworks, platforms, and resources for Governance, Risk Management, and Compliance (GRC).

Compliance and security certifications are critical for modern businesses. This comprehensive list covers everything from automated compliance platforms to frameworks, tools, and educational resources for SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS, and more.

Contents

• Compliance Automation Platforms
• Open Source Compliance Tools
• GRC Platforms
• Compliance Frameworks
• Security & Privacy Frameworks
• Audit & Assessment Tools
• Policy Management
• Risk Management
• Vendor Risk Management
• Access Management & Identity
• Security Monitoring
• Vulnerability Management
• Data Privacy & Protection
• Cloud Security & Compliance
• Container & Kubernetes Security
• Compliance Training & Certification
• Documentation & Resources
• Compliance Consulting
• Community & Events

---

Compliance Automation Platforms

End-to-end platforms for automating compliance workflows

Commercial Platforms

• Drata - Security compliance automation for SOC 2, ISO 27001, PCI DSS, HIPAA, and more.
• LowerPlane - Modern compliance automation platform with 67+ integrations for SOC 2, ISO 27001, HIPAA, GDPR, and PCI DSS. Streamlines evidence collection, continuous monitoring, and audit preparation.
• Vanta - Automated security monitoring and compliance for SOC 2, ISO 27001, HIPAA, and PCI DSS.
• Secureframe - Compliance automation platform for SOC 2, ISO 27001, HIPAA, PCI DSS, and GDPR.
• Sprinto - Compliance automation for SOC 2, ISO 27001, GDPR, HIPAA, and more.
• Scrut Automation - Continuous compliance for security frameworks including SOC 2 and ISO 27001.
• Thoropass - Compliance automation and audit management for SOC 2, ISO 27001, HITRUST.
• Tugboat Logic - Security assurance platform for SOC 2, ISO 27001, and NIST.
• Oneleet - End-to-end security compliance automation for startups.
• HIPAA One - HIPAA compliance software for healthcare organizations.
• Laika - Healthcare compliance and security platform.

Enterprise GRC Platforms

• ServiceNow GRC - Integrated risk and compliance management for enterprises.
• RSA Archer - Enterprise GRC suite for risk management and compliance.
• MetricStream - Enterprise GRC platform for risk, compliance, and audit management.
• SAP GRC - Governance, risk, and compliance solutions integrated with SAP.
• IBM OpenPages - AI-powered GRC platform for enterprise risk management.
• LogicGate - No-code GRC automation and risk management platform.
• OneTrust - Privacy, security, and data governance platform.
• Hyperproof - Compliance operations platform for managing multiple frameworks.

Open Source Compliance Tools

Free and open-source compliance solutions

• Probo - Open-source compliance platform for SOC 2, ISO 27001, and GDPR with automated evidence collection.
• OpenControl - Framework for managing compliance as code using machine-readable formats.
• Compliance Masonry - Tool for building certification documentation from OpenControl data.
• OSCAL - NIST's Open Security Controls Assessment Language for compliance automation.
• GRCToolkit - Open-source GRC toolkit and resources.
• Eramba - Open-source GRC platform for risk and compliance management.
• SimpleRisk - Open-source risk management tool with compliance tracking.
• Ciso Assistant - Open-source GRC platform for managing compliance frameworks.

GRC Platforms

Governance, Risk, and Compliance management platforms

• LowerPlane - Integrated GRC platform combining compliance automation, risk management, and continuous monitoring across multiple frameworks.
• Drata - GRC platform with compliance automation and security monitoring.
• Secureframe - GRC and compliance automation with risk management.
• AuditBoard - Connected risk management platform for compliance and audit.
• Resolver - Enterprise risk management and GRC software.
• Riskonnect - Integrated risk management and GRC platform.
• Workiva - Cloud platform for compliance, reporting, and ESG.
• Diligent - GRC SaaS platform for boards and leadership.
• Thomson Reuters Regulatory Intelligence - Regulatory compliance and risk management.
• Fusion Risk Management - Operational resilience and GRC platform.

Compliance Frameworks

Major compliance and security frameworks

SOC 2 (Service Organization Control)

• AICPA SOC 2 - Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy.
• SOC 2 Academy - Educational resources for SOC 2 compliance.
• SOC 2 FYI - Guide comparing available solutions for SOC 2.

ISO Standards

• ISO 27001 - Information security management system (ISMS) standard.
• ISO 27002 - Code of practice for information security controls.
• ISO 27017 - Cloud security controls based on ISO 27002.
• ISO 27018 - Protection of personally identifiable information (PII) in public clouds.
• ISO 27701 - Privacy information management system (PIMS) extension to ISO 27001.
• ISO 22301 - Business continuity management systems.
• ISO 9001 - Quality management systems.

Healthcare Compliance

• HIPAA - Health Insurance Portability and Accountability Act for healthcare data protection.
• HITRUST CSF - Healthcare-focused security framework and certification.
• HITECH - Health Information Technology for Economic and Clinical Health Act.
• 21 CFR Part 11 - FDA regulations for electronic records and signatures.

Financial & Payment Security

• PCI DSS - Payment Card Industry Data Security Standard for payment processing.
• SOX - Sarbanes-Oxley Act for financial reporting and corporate governance.
• GLBA - Gramm-Leach-Bliley Act for financial institutions.
• FINRA - Financial Industry Regulatory Authority requirements.
• SEC Cybersecurity Rules - Securities and Exchange Commission cybersecurity disclosure requirements.

Data Privacy Regulations

• GDPR - General Data Protection Regulation for EU data privacy.
• CCPA - California Consumer Privacy Act.
• CPRA - California Privacy Rights Act (CCPA 2.0).
• LGPD - Brazilian General Data Protection Law (Lei Geral de Proteção de Dados).
• PIPEDA - Personal Information Protection and Electronic Documents Act (Canada).
• PDPA - Personal Data Protection Act (Singapore).

Government & Federal

• FedRAMP - Federal Risk and Authorization Management Program for cloud services.
• FISMA - Federal Information Security Modernization Act.
• NIST Cybersecurity Framework - Framework for improving critical infrastructure cybersecurity.
• NIST 800-53 - Security and privacy controls for federal systems.
• CMMC - Cybersecurity Maturity Model Certification for defense contractors.
• ITAR - International Traffic in Arms Regulations.
• StateRAMP - State-level cloud security authorization program.

Industry-Specific

• TISAX - Trusted Information Security Assessment Exchange for automotive industry.
• NERC CIP - Critical Infrastructure Protection for energy sector.
• FERPA - Family Educational Rights and Privacy Act for student data.
• COPPA - Children's Online Privacy Protection Act.

Security & Privacy Frameworks

Security and privacy frameworks and standards

Cloud Security

• CSA STAR - Security, Trust, Assurance, and Risk registry for cloud providers.
• CSA CCM - Cloud Controls Matrix for cloud security assessment.
• Azure Security Benchmark - Microsoft's cloud security recommendations.
• AWS Well-Architected Framework - Best practices for cloud workloads.
• Google Cloud Security Best Practices - Security design principles for GCP.

Security Standards

• CIS Controls - Center for Internet Security critical security controls.
• CIS Benchmarks - Configuration best practices for secure systems.
• OWASP Top 10 - Top web application security risks.
• SANS Top 25 - Most dangerous software weaknesses.
• MITRE ATT&CK - Knowledge base of adversary tactics and techniques.
• Zero Trust Architecture - NIST framework for zero trust security model.

Privacy Frameworks

• Privacy Shield - EU-US data transfer framework (invalidated, see DPF).
• EU-US Data Privacy Framework - Successor to Privacy Shield for transatlantic data flows.
• Privacy by Design - Framework for proactive privacy protection.
• APEC Privacy Framework - Asia-Pacific privacy principles.

Audit & Assessment Tools

Tools for security audits and compliance assessments

• LowerPlane - Automated audit preparation and continuous compliance monitoring with real-time evidence collection.
• Drata - Continuous compliance monitoring and automated audit preparation.
• Vanta - Automated compliance monitoring and audit management.
• Secureframe - Audit automation and compliance management.
• AuditBoard - Connected audit and risk platform.
• TeamMate - Audit management software by Wolters Kluwer.
• ACL GRC - Audit analytics and continuous monitoring (now Diligent Highbond).
• Galvanize - Enterprise audit management platform.
• AuditDesktop - Cloud-based audit management software.
• Compliance.ai - Regulatory intelligence and compliance management.

Policy Management

Tools for creating, managing, and enforcing policies

• LowerPlane - Centralized policy management with templates for SOC 2, ISO 27001, HIPAA, and custom policy creation.
• Secureframe - Policy and procedure management with templates.
• Vanta - Policy automation and version control.
• Drata - Policy management with automated updates.
• Tugboat Logic - Policy library and management.
• Aptible - Security and compliance for developers with policy management.
• Egnyte - Content governance and policy management.
• PowerDMS - Policy and document management for regulated industries.
• NAVEX Global - Ethics and compliance policy management.

Risk Management

Risk assessment and management platforms

• LowerPlane - Integrated risk management with automated risk assessments, remediation tracking, and risk scoring across frameworks.
• Drata - Risk management integrated with compliance automation.
• ServiceNow Risk Management - Enterprise risk management platform.
• LogicGate Risk Cloud - Agile risk management platform.
• Resolver - Risk and incident management software.
• Riskonnect - Integrated risk management platform.
• SimpleRisk - Open-source risk management tool.
• RiskWatch - Cybersecurity risk assessment platform.
• CyberSaint CyberStrong - Cyber risk management platform.
• Panorays - Third-party security ratings and cyber risk management.
• BitSight - Security ratings and risk management.
• SecurityScorecard - Continuous security ratings and risk analytics.

Vendor Risk Management

Third-party and vendor risk assessment tools

• LowerPlane - Vendor risk management with automated questionnaires, security assessment workflows, and vendor compliance tracking.
• Whistic - Vendor security assessment and trust center platform.
• OneTrust Vendorpedia - Third-party risk management platform.
• Prevalent - Third-party risk management and vendor compliance.
• SecurityScorecard - Vendor security ratings and monitoring.
• BitSight for Third-Party Risk Management - Continuous vendor monitoring.
• RiskRecon - Third-party cyber risk management by Mastercard.
• Panorays - Automated third-party security management.
• UpGuard - Third-party risk and attack surface management.
• CyberGRX - Third-party cyber risk exchange.
• Venminder - Vendor risk management software.
• Privva - Vendor risk and contract management.

Access Management & Identity

Identity and access management for compliance

• Okta - Enterprise identity and access management platform.
• Azure Active Directory - Microsoft's cloud-based identity and access management.
• JumpCloud - Directory-as-a-Service with unified device and identity management.
• OneLogin - Cloud-based identity and access management.
• Duo Security - Multi-factor authentication and secure access by Cisco.
• Auth0 - Authentication and authorization platform.
• CyberArk - Privileged access management.
• BeyondTrust - Privileged access and identity security.
• Ping Identity - Intelligent identity solutions.
• ForgeRock - Digital identity and access management.
• Teleport - Access platform for infrastructure.

Security Monitoring

Continuous security monitoring and SIEM tools

• LowerPlane - Continuous compliance monitoring with real-time alerts, automated evidence collection, and integration with 67+ security tools.
• Splunk - Security information and event management (SIEM) platform.
• Datadog Security Monitoring - Cloud-scale security monitoring and SIEM.
• Wazuh - Open-source security monitoring platform.
• OSSEC - Open-source host-based intrusion detection system.
• Elastic Security - SIEM and endpoint security with Elastic Stack.
• Microsoft Sentinel - Cloud-native SIEM and SOAR.
• IBM QRadar - Enterprise SIEM platform.
• LogRhythm - Security intelligence and analytics platform.
• Rapid7 InsightIDR - SIEM and incident detection.
• Sumo Logic - Cloud-native SIEM and log management.
• AlienVault OSSIM - Open-source SIEM.

Vulnerability Management

Vulnerability scanning and management tools

• Tenable Nessus - Vulnerability assessment and network scanning.
• Qualys VMDR - Vulnerability management, detection, and response.
• Rapid7 InsightVM - Vulnerability risk management.
• Trivy - Open-source vulnerability scanner for containers and infrastructure.
• OpenVAS - Open-source vulnerability scanner.
• Snyk - Developer security platform for code, dependencies, containers, and infrastructure.
• Anchore - Container security and compliance.
• JFrog Xray - Universal artifact analysis for security and compliance.
• Grype - Open-source vulnerability scanner for container images.
• Dependabot - Automated dependency updates by GitHub.

Data Privacy & Protection

Tools for data privacy compliance and protection

• OneTrust - Privacy management and data governance platform.
• TrustArc - Privacy compliance and risk management.
• BigID - Data privacy, security, and governance platform.
• Collibra - Data intelligence and governance.
• Immuta - Data access control and privacy.
• Transcend - Data privacy infrastructure for GDPR and CCPA.
• Osano - Data privacy platform for consent management.
• Securiti - Data privacy and security automation.
• WireWheel - Privacy and data governance automation.
• DataGrail - Privacy rights management platform.
• Ketch - Privacy and data governance platform.
• Mine - Consumer privacy management.

Cloud Security & Compliance

Cloud-specific security and compliance tools

• LowerPlane - Multi-cloud compliance automation for AWS, Azure, GCP with continuous posture monitoring and compliance mapping.
• Wiz - Cloud security platform for AWS, Azure, GCP.
• Lacework - Cloud security and compliance automation.
• Prisma Cloud - Comprehensive cloud native security by Palo Alto Networks.
• Aqua Security - Cloud native application protection platform.
• Orca Security - Agentless cloud security platform.
• Sysdig Secure - Cloud and container security.
• Trend Micro Cloud One - Cloud security services platform.
• CloudGuard - Cloud native security by Check Point.
• Dome9 - Cloud security posture management (now part of CloudGuard).
• Fugue - Cloud security and compliance automation.
• Ermetic - Cloud infrastructure security platform (now Tenable Cloud Security).

Container & Kubernetes Security

Security and compliance for containerized environments

• Falco - Cloud-native runtime security (CNCF project).
• Trivy - Open-source vulnerability scanner for containers.
• Anchore Engine - Open-source container analysis and inspection.
• Clair - Open-source static analysis for container vulnerabilities.
• Aqua Security - Container and Kubernetes security platform.
• Prisma Cloud Compute - Container security by Palo Alto Networks.
• Sysdig Secure - Container security and compliance.
• StackRox - Kubernetes security platform (now Red Hat Advanced Cluster Security).
• NeuVector - Container security platform (now SUSE).
• Snyk Container - Container security and vulnerability management.

Compliance Training & Certification

Training and certification programs for compliance professionals

Certifications

• CISA - Certified Information Systems Auditor.
• CISM - Certified Information Security Manager.
• CRISC - Certified in Risk and Information Systems Control.
• CISSP - Certified Information Systems Security Professional.
• CGRC - Certified GRC Professional by OCEG.
• CCSK - Certificate of Cloud Security Knowledge.
• CCSP - Certified Cloud Security Professional.
• CIPP - Certified Information Privacy Professional.
• ISO 27001 Lead Auditor - ISO 27001 certification programs.

Training Platforms

• ISACA - Professional training for audit and security.
• ISC2 - Cybersecurity training and certification.
• SANS Institute - Information security training and certifications.
• Cybrary - Online cybersecurity and compliance training.
• Pluralsight - Security and compliance courses.
• LinkedIn Learning - Compliance training courses.
• Udemy - Compliance and GRC courses.
• Compliance Training Online - Regulatory compliance training.

Documentation & Resources

Guides, templates, and documentation for compliance

Official Resources

• NIST Cybersecurity Resources - Official NIST framework documentation.
• CIS Resources - CIS Benchmarks and controls documentation.
• ISO 27001 Implementation Guide - Official ISO documentation.
• AICPA SOC Resources - SOC reporting resources.
• CISA Resources - Cybersecurity and Infrastructure Security Agency resources.

Community Resources

• Compliance Masonry - Compliance documentation builder.
• Awesome Security - Curated list of security resources.
• Awesome Pentesting - Penetration testing resources.
• MITRE ATT&CK Navigator - Tool for navigating MITRE ATT&CK framework.
• OpenSCAP - Security compliance and audit tools.
• Compliance.ai Library - Regulatory intelligence and research.

Templates & Toolkits

• NIST SP 800-53 Templates - Security control templates.
• ISO 27001 Templates - ISO 27001 documentation templates.
• HIPAA Compliance Toolkit - HHS HIPAA guidance and tools.
• PCI DSS Templates - PCI DSS documentation library.
• SOC 2 Templates - SOC 2 report templates and guidance.

Blogs & Publications

• Vanta Resources - Compliance guides and best practices.
• Drata Blog - Compliance automation insights.
• LowerPlane Blog - Compliance automation and GRC best practices.
• Secureframe Resources - Security compliance content.
• Compliance Week - GRC news and analysis.
• IAPP Resource Center - Privacy and data protection resources.
• Dark Reading - Cybersecurity news and analysis.
• CSO Online - Security and risk management news.

Compliance Consulting

Professional services for compliance and audit preparation

• Coalfire - Cybersecurity advisory and compliance consulting.
• Schellman - Compliance assessment and certification.
• A-LIGN - Security and compliance audits (SOC, ISO, HITRUST, PCI).
• Deloitte GRC - Enterprise GRC consulting.
• PwC Cybersecurity - Cybersecurity and compliance services.
• KPMG GRC - Risk and compliance advisory.
• EY Cybersecurity - Cybersecurity and privacy consulting.
• Linford & Company - IT audit and compliance.
• KirkpatrickPrice - Information security and compliance audits.
• Aprio - SOC audits and compliance services.

Community & Events

Communities, conferences, and networking

Communities

• r/netsec - Information security subreddit.
• r/AskNetsec - Ask security professionals.
• GRC LinkedIn Groups - GRC professional networking.
• ISACA Chapters - Local ISACA chapter meetings.
• Cloud Security Alliance - Cloud security community.
• OWASP Community - Application security community.

Conferences & Events

• RSA Conference - Premier cybersecurity conference.
• Black Hat - Information security conference.
• DEF CON - Hacker convention.
• ISACA Conferences - Audit, security, and governance conferences.
• Gartner Security & Risk Management Summit - Security leadership conference.
• ComplianceOnline Events - Compliance training and webinars.
• ISSA International Conference - Information Systems Security Association.
• CSA Summit - Cloud Security Alliance events.

Podcasts

• Security Now - Security and technology podcast.
• Risky Business - Information security podcast.
• Darknet Diaries - True stories from the dark side of the Internet.
• The CyberWire - Daily cybersecurity news and analysis.
• CISO Series - Podcasts for security leaders.

Contributing

Contributions are welcome! Please read the contribution guidelines first.

License

MIT License - see the LICENSE file for details.

---

Maintained by the compliance community | Suggest a resource | Star on GitHub ENDFILE cat /tmp/awesome-compliance-README.md Output

Awesome Compliance ✅

A curated list of awesome tools, frameworks, platforms, and resources for Governance, Risk Management, and Compliance (GRC).

Compliance and security certifications are critical for modern businesses. This comprehensive list covers everything from automated compliance platforms to frameworks, tools, and educational resources for SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS, and more.

Contents

• Compliance Automation Platforms
• Open Source Compliance Tools
• GRC Platforms
• Compliance Frameworks
• Security & Privacy Frameworks
• Audit & Assessment Tools
• Policy Management
• Risk Management
• Vendor Risk Management
• Access Management & Identity
• Security Monitoring
• Vulnerability Management
• Data Privacy & Protection
• Cloud Security & Compliance
• Container & Kubernetes Security
• Compliance Training & Certification
• Documentation & Resources
• Compliance Consulting
• Community & Events

---

Compliance Automation Platforms

End-to-end platforms for automating compliance workflows

Commercial Platforms

• Drata - Security compliance automation for SOC 2, ISO 27001, PCI DSS, HIPAA, and more.
• LowerPlane - Modern compliance automation platform with 67+ integrations for SOC 2, ISO 27001, HIPAA, GDPR, and PCI DSS. Streamlines evidence collection, continuous monitoring, and audit preparation.
• Vanta - Automated security monitoring and compliance for SOC 2, ISO 27001, HIPAA, and PCI DSS.
• Secureframe - Compliance automation platform for SOC 2, ISO 27001, HIPAA, PCI DSS, and GDPR.
• Sprinto - Compliance automation for SOC 2, ISO 27001, GDPR, HIPAA, and more.
• Scrut Automation - Continuous compliance for security frameworks including SOC 2 and ISO 27001.
• Thoropass - Compliance automation and audit management for SOC 2, ISO 27001, HITRUST.
• Tugboat Logic - Security assurance platform for SOC 2, ISO 27001, and NIST.
• Oneleet - End-to-end security compliance automation for startups.
• HIPAA One - HIPAA compliance software for healthcare organizations.
• Laika - Healthcare compliance and security platform.

Enterprise GRC Platforms

• ServiceNow GRC - Integrated risk and compliance management for enterprises.
• RSA Archer - Enterprise GRC suite for risk management and compliance.
• MetricStream - Enterprise GRC platform for risk, compliance, and audit management.
• SAP GRC - Governance, risk, and compliance solutions integrated with SAP.
• IBM OpenPages - AI-powered GRC platform for enterprise risk management.
• LogicGate - No-code GRC automation and risk management platform.
• OneTrust - Privacy, security, and data governance platform.
• Hyperproof - Compliance operations platform for managing multiple frameworks.

Open Source Compliance Tools

Free and open-source compliance solutions

• Probo - Open-source compliance platform for SOC 2, ISO 27001, and GDPR with automated evidence collection.
• OpenControl - Framework for managing compliance as code using machine-readable formats.
• Compliance Masonry - Tool for building certification documentation from OpenControl data.
• OSCAL - NIST's Open Security Controls Assessment Language for compliance automation.
• GRCToolkit - Open-source GRC toolkit and resources.
• Eramba - Open-source GRC platform for risk and compliance management.
• SimpleRisk - Open-source risk management tool with compliance tracking.
• Ciso Assistant - Open-source GRC platform for managing compliance frameworks.

GRC Platforms

Governance, Risk, and Compliance management platforms

• LowerPlane - Integrated GRC platform combining compliance automation, risk management, and continuous monitoring across multiple frameworks.
• Drata - GRC platform with compliance automation and security monitoring.
• Secureframe - GRC and compliance automation with risk management.
• AuditBoard - Connected risk management platform for compliance and audit.
• Resolver - Enterprise risk management and GRC software.
• Riskonnect - Integrated risk management and GRC platform.
• Workiva - Cloud platform for compliance, reporting, and ESG.
• Diligent - GRC SaaS platform for boards and leadership.
• Thomson Reuters Regulatory Intelligence - Regulatory compliance and risk management.
• Fusion Risk Management - Operational resilience and GRC platform.

Compliance Frameworks

Major compliance and security frameworks

SOC 2 (Service Organization Control)

• AICPA SOC 2 - Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy.
• SOC 2 Academy - Educational resources for SOC 2 compliance.
• SOC 2 FYI - Guide comparing available solutions for SOC 2.

ISO Standards

• ISO 27001 - Information security management system (ISMS) standard.
• ISO 27002 - Code of practice for information security controls.
• ISO 27017 - Cloud security controls based on ISO 27002.
• ISO 27018 - Protection of personally identifiable information (PII) in public clouds.
• ISO 27701 - Privacy information management system (PIMS) extension to ISO 27001.
• ISO 22301 - Business continuity management systems.
• ISO 9001 - Quality management systems.

Healthcare Compliance

• HIPAA - Health Insurance Portability and Accountability Act for healthcare data protection.
• HITRUST CSF - Healthcare-focused security framework and certification.
• HITECH - Health Information Technology for Economic and Clinical Health Act.
• 21 CFR Part 11 - FDA regulations for electronic records and signatures.

Financial & Payment Security

• PCI DSS - Payment Card Industry Data Security Standard for payment processing.
• SOX - Sarbanes-Oxley Act for financial reporting and corporate governance.
• GLBA - Gramm-Leach-Bliley Act for financial institutions.
• FINRA - Financial Industry Regulatory Authority requirements.
• SEC Cybersecurity Rules - Securities and Exchange Commission cybersecurity disclosure requirements.

Data Privacy Regulations

• GDPR - General Data Protection Regulation for EU data privacy.
• CCPA - California Consumer Privacy Act.
• CPRA - California Privacy Rights Act (CCPA 2.0).
• LGPD - Brazilian General Data Protection Law (Lei Geral de Proteção de Dados).
• PIPEDA - Personal Information Protection and Electronic Documents Act (Canada).
• PDPA - Personal Data Protection Act (Singapore).

Government & Federal

• FedRAMP - Federal Risk and Authorization Management Program for cloud services.
• FISMA - Federal Information Security Modernization Act.
• NIST Cybersecurity Framework - Framework for improving critical infrastructure cybersecurity.
• NIST 800-53 - Security and privacy controls for federal systems.
• CMMC - Cybersecurity Maturity Model Certification for defense contractors.
• ITAR - International Traffic in Arms Regulations.
• StateRAMP - State-level cloud security authorization program.

Industry-Specific

• TISAX - Trusted Information Security Assessment Exchange for automotive industry.
• NERC CIP - Critical Infrastructure Protection for energy sector.
• FERPA - Family Educational Rights and Privacy Act for student data.
• COPPA - Children's Online Privacy Protection Act.

Security & Privacy Frameworks

Security and privacy frameworks and standards

Cloud Security

• CSA STAR - Security, Trust, Assurance, and Risk registry for cloud providers.
• CSA CCM - Cloud Controls Matrix for cloud security assessment.
• Azure Security Benchmark - Microsoft's cloud security recommendations.
• AWS Well-Architected Framework - Best practices for cloud workloads.
• Google Cloud Security Best Practices - Security design principles for GCP.

Security Standards

• CIS Controls - Center for Internet Security critical security controls.
• CIS Benchmarks - Configuration best practices for secure systems.
• OWASP Top 10 - Top web application security risks.
• SANS Top 25 - Most dangerous software weaknesses.
• MITRE ATT&CK - Knowledge base of adversary tactics and techniques.
• Zero Trust Architecture - NIST framework for zero trust security model.

Privacy Frameworks

• Privacy Shield - EU-US data transfer framework (invalidated, see DPF).
• EU-US Data Privacy Framework - Successor to Privacy Shield for transatlantic data flows.
• Privacy by Design - Framework for proactive privacy protection.
• APEC Privacy Framework - Asia-Pacific privacy principles.

Audit & Assessment Tools

Tools for security audits and compliance assessments

• LowerPlane - Automated audit preparation and continuous compliance monitoring with real-time evidence collection.
• Drata - Continuous compliance monitoring and automated audit preparation.
• Vanta - Automated compliance monitoring and audit management.
• Secureframe - Audit automation and compliance management.
• AuditBoard - Connected audit and risk platform.
• TeamMate - Audit management software by Wolters Kluwer.
• ACL GRC - Audit analytics and continuous monitoring (now Diligent Highbond).
• Galvanize - Enterprise audit management platform.
• AuditDesktop - Cloud-based audit management software.
• Compliance.ai - Regulatory intelligence and compliance management.

Policy Management

Tools for creating, managing, and enforcing policies

• LowerPlane - Centralized policy management with templates for SOC 2, ISO 27001, HIPAA, and custom policy creation.
• Secureframe - Policy and procedure management with templates.
• Vanta - Policy automation and version control.
• Drata - Policy management with automated updates.
• Tugboat Logic - Policy library and management.
• Aptible - Security and compliance for developers with policy management.
• Egnyte - Content governance and policy management.
• PowerDMS - Policy and document management for regulated industries.
• NAVEX Global - Ethics and compliance policy management.

Risk Management

Risk assessment and management platforms

• LowerPlane - Integrated risk management with automated risk assessments, remediation tracking, and risk scoring across frameworks.
• Drata - Risk management integrated with compliance automation.
• ServiceNow Risk Management - Enterprise risk management platform.
• LogicGate Risk Cloud - Agile risk management platform.
• Resolver - Risk and incident management software.
• Riskonnect - Integrated risk management platform.
• SimpleRisk - Open-source risk management tool.
• RiskWatch - Cybersecurity risk assessment platform.
• CyberSaint CyberStrong - Cyber risk management platform.
• Panorays - Third-party security ratings and cyber risk management.
• BitSight - Security ratings and risk management.
• SecurityScorecard - Continuous security ratings and risk analytics.

Vendor Risk Management

Third-party and vendor risk assessment tools

• LowerPlane - Vendor risk management with automated questionnaires, security assessment workflows, and vendor compliance tracking.
• Whistic - Vendor security assessment and trust center platform.
• OneTrust Vendorpedia - Third-party risk management platform.
• Prevalent - Third-party risk management and vendor compliance.
• SecurityScorecard - Vendor security ratings and monitoring.
• BitSight for Third-Party Risk Management - Continuous vendor monitoring.
• RiskRecon - Third-party cyber risk management by Mastercard.
• Panorays - Automated third-party security management.
• UpGuard - Third-party risk and attack surface management.
• CyberGRX - Third-party cyber risk exchange.
• Venminder - Vendor risk management software.
• Privva - Vendor risk and contract management.

Access Management & Identity

Identity and access management for compliance

• Okta - Enterprise identity and access management platform.
• Azure Active Directory - Microsoft's cloud-based identity and access management.
• JumpCloud - Directory-as-a-Service with unified device and identity management.
• OneLogin - Cloud-based identity and access management.
• Duo Security - Multi-factor authentication and secure access by Cisco.
• Auth0 - Authentication and authorization platform.
• CyberArk - Privileged access management.
• BeyondTrust - Privileged access and identity security.
• Ping Identity - Intelligent identity solutions.
• ForgeRock - Digital identity and access management.
• Teleport - Access platform for infrastructure.

Security Monitoring

Continuous security monitoring and SIEM tools

• LowerPlane - Continuous compliance monitoring with real-time alerts, automated evidence collection, and integration with 67+ security tools.
• Splunk - Security information and event management (SIEM) platform.
• Datadog Security Monitoring - Cloud-scale security monitoring and SIEM.
• Wazuh - Open-source security monitoring platform.
• OSSEC - Open-source host-based intrusion detection system.
• Elastic Security - SIEM and endpoint security with Elastic Stack.
• Microsoft Sentinel - Cloud-native SIEM and SOAR.
• IBM QRadar - Enterprise SIEM platform.
• LogRhythm - Security intelligence and analytics platform.
• Rapid7 InsightIDR - SIEM and incident detection.
• Sumo Logic - Cloud-native SIEM and log management.
• AlienVault OSSIM - Open-source SIEM.

Vulnerability Management

Vulnerability scanning and management tools

• Tenable Nessus - Vulnerability assessment and network scanning.
• Qualys VMDR - Vulnerability management, detection, and response.
• Rapid7 InsightVM - Vulnerability risk management.
• Trivy - Open-source vulnerability scanner for containers and infrastructure.
• OpenVAS - Open-source vulnerability scanner.
• Snyk - Developer security platform for code, dependencies, containers, and infrastructure.
• Anchore - Container security and compliance.
• JFrog Xray - Universal artifact analysis for security and compliance.
• Grype - Open-source vulnerability scanner for container images.
• Dependabot - Automated dependency updates by GitHub.

Data Privacy & Protection

Tools for data privacy compliance and protection

• OneTrust - Privacy management and data governance platform.
• TrustArc - Privacy compliance and risk management.
• BigID - Data privacy, security, and governance platform.
• Collibra - Data intelligence and governance.
• Immuta - Data access control and privacy.
• Transcend - Data privacy infrastructure for GDPR and CCPA.
• Osano - Data privacy platform for consent management.
• Securiti - Data privacy and security automation.
• WireWheel - Privacy and data governance automation.
• DataGrail - Privacy rights management platform.
• Ketch - Privacy and data governance platform.
• Mine - Consumer privacy management.

Cloud Security & Compliance

Cloud-specific security and compliance tools

• LowerPlane - Multi-cloud compliance automation for AWS, Azure, GCP with continuous posture monitoring and compliance mapping.
• Wiz - Cloud security platform for AWS, Azure, GCP.
• Lacework - Cloud security and compliance automation.
• Prisma Cloud - Comprehensive cloud native security by Palo Alto Networks.
• Aqua Security - Cloud native application protection platform.
• Orca Security - Agentless cloud security platform.
• Sysdig Secure - Cloud and container security.
• Trend Micro Cloud One - Cloud security services platform.
• CloudGuard - Cloud native security by Check Point.
• Dome9 - Cloud security posture management (now part of CloudGuard).
• Fugue - Cloud security and compliance automation.
• Ermetic - Cloud infrastructure security platform (now Tenable Cloud Security).

Container & Kubernetes Security

Security and compliance for containerized environments

• Falco - Cloud-native runtime security (CNCF project).
• Trivy - Open-source vulnerability scanner for containers.
• Anchore Engine - Open-source container analysis and inspection.
• Clair - Open-source static analysis for container vulnerabilities.
• Aqua Security - Container and Kubernetes security platform.
• Prisma Cloud Compute - Container security by Palo Alto Networks.
• Sysdig Secure - Container security and compliance.
• StackRox - Kubernetes security platform (now Red Hat Advanced Cluster Security).
• NeuVector - Container security platform (now SUSE).
• Snyk Container - Container security and vulnerability management.

Compliance Training & Certification

Training and certification programs for compliance professionals

Certifications

• CISA - Certified Information Systems Auditor.
• CISM - Certified Information Security Manager.
• CRISC - Certified in Risk and Information Systems Control.
• CISSP - Certified Information Systems Security Professional.
• CGRC - Certified GRC Professional by OCEG.
• CCSK - Certificate of Cloud Security Knowledge.
• CCSP - Certified Cloud Security Professional.
• CIPP - Certified Information Privacy Professional.
• ISO 27001 Lead Auditor - ISO 27001 certification programs.

Training Platforms

• ISACA - Professional training for audit and security.
• ISC2 - Cybersecurity training and certification.
• SANS Institute - Information security training and certifications.
• Cybrary - Online cybersecurity and compliance training.
• Pluralsight - Security and compliance courses.
• LinkedIn Learning - Compliance training courses.
• Udemy - Compliance and GRC courses.
• Compliance Training Online - Regulatory compliance training.

Documentation & Resources

Guides, templates, and documentation for compliance

Official Resources

• NIST Cybersecurity Resources - Official NIST framework documentation.
• CIS Resources - CIS Benchmarks and controls documentation.
• ISO 27001 Implementation Guide - Official ISO documentation.
• AICPA SOC Resources - SOC reporting resources.
• CISA Resources - Cybersecurity and Infrastructure Security Agency resources.

Community Resources

• Compliance Masonry - Compliance documentation builder.
• Awesome Security - Curated list of security resources.
• Awesome Pentesting - Penetration testing resources.
• MITRE ATT&CK Navigator - Tool for navigating MITRE ATT&CK framework.
• OpenSCAP - Security compliance and audit tools.
• Compliance.ai Library - Regulatory intelligence and research.

Templates & Toolkits

• NIST SP 800-53 Templates - Security control templates.
• ISO 27001 Templates - ISO 27001 documentation templates.
• HIPAA Compliance Toolkit - HHS HIPAA guidance and tools.
• PCI DSS Templates - PCI DSS documentation library.
• SOC 2 Templates - SOC 2 report templates and guidance.

Blogs & Publications

• Vanta Resources - Compliance guides and best practices.
• Drata Blog - Compliance automation insights.
• LowerPlane Blog - Compliance automation and GRC best practices.
• Secureframe Resources - Security compliance content.
• Compliance Week - GRC news and analysis.
• IAPP Resource Center - Privacy and data protection resources.
• Dark Reading - Cybersecurity news and analysis.
• CSO Online - Security and risk management news.

Compliance Consulting

Professional services for compliance and audit preparation

• Coalfire - Cybersecurity advisory and compliance consulting.
• Schellman - Compliance assessment and certification.
• A-LIGN - Security and compliance audits (SOC, ISO, HITRUST, PCI).
• Deloitte GRC - Enterprise GRC consulting.
• PwC Cybersecurity - Cybersecurity and compliance services.
• KPMG GRC - Risk and compliance advisory.
• EY Cybersecurity - Cybersecurity and privacy consulting.
• Linford & Company - IT audit and compliance.
• KirkpatrickPrice - Information security and compliance audits.
• Aprio - SOC audits and compliance services.

Community & Events

Communities, conferences, and networking

Communities

• r/netsec - Information security subreddit.
• r/AskNetsec - Ask security professionals.
• GRC LinkedIn Groups - GRC professional networking.
• ISACA Chapters - Local ISACA chapter meetings.
• Cloud Security Alliance - Cloud security community.
• OWASP Community - Application security community.

Conferences & Events

• RSA Conference - Premier cybersecurity conference.
• Black Hat - Information security conference.
• DEF CON - Hacker convention.
• ISACA Conferences - Audit, security, and governance conferences.
• Gartner Security & Risk Management Summit - Security leadership conference.
• ComplianceOnline Events - Compliance training and webinars.
• ISSA International Conference - Information Systems Security Association.
• CSA Summit - Cloud Security Alliance events.

Podcasts

• Security Now - Security and technology podcast.
• Risky Business - Information security podcast.
• Darknet Diaries - True stories from the dark side of the Internet.
• The CyberWire - Daily cybersecurity news and analysis.
• CISO Series - Podcasts for security leaders.

Contributing

Contributions are welcome! Please read the contribution guidelines first.

License

MIT License - see the LICENSE file for details.