Framework library
Your Frameworks, Loaded and Ready to Assess
Every framework below is loaded by our team, kept up to date and ready to use. Controls are mapped across frameworks, so work done for one counts toward the others.
Information Security
UAE IAThe UAE Information Assurance Standard sets the information security controls expected of UAE government entities and critical sectors.Information SecurityISO 27001ISO 27001 is the international standard for an information security management system.Information SecurityISO 27017ISO 27017 adds cloud-specific guidance to the ISO 27002 controls, plus extra controls for cloud customers and providers..Information SecurityNIST 800-53NIST 800-53 is the US catalogue of security and privacy controls, organised into control families.Information SecurityCIS ControlsThe CIS Critical Security Controls are prioritised controls broken into safeguards.Information SecurityPCI DSSPCI DSS is the payment card industry's security standard for anyone who stores, processes or transmits cardholder data..Information SecuritySAMA CSFThe Saudi Central Bank's Cyber Security Framework applies to banks, insurers and other regulated financial institutions in Saudi Arabia.Information SecuritySOC 2SOC 2 is the AICPA attestation framework that service organisations use to show customers their controls meet the Trust Services Criteria for security, availability, processing integrity, confidentiality and privacy..Information Security
Business Continuity
NCEMA 7000NCEMA 7000 is the UAE's business continuity management standard from the National Emergency Crisis and Disaster Management Authority.Business ContinuityISO 22301ISO 22301 is the international standard for a business continuity management system, and the route to certification..Business Continuity
Privacy
UAE PDPLThe UAE Personal Data Protection Law sets out how organisations in the UAE collect, use and protect personal data, and the rights people have over it..PrivacyISO 27701ISO 27701 sets out requirements for a privacy information management system, with controls for both data controllers and processors..PrivacyGDPRThe EU General Data Protection Regulation applies to any organisation handling the personal data of people in the EU, wherever the organisation is based..Privacy
AI and IT Services
ISO 42001ISO 42001 is the first international standard for an AI management system.AI ManagementNIST AI RMFThe NIST AI Risk Management Framework helps organisations manage the risks of AI systems and build trustworthy AI.AI ManagementISO 20000ISO 20000 is the international standard for an IT service management system.IT Service Management
Quality, Safety and Risk
ISO 9001ISO 9001 is the world's most widely used quality management standard..Quality ManagementISO 45001ISO 45001 sets out requirements for an occupational health and safety management system, for organisations of any size..Health and SafetyCOSO ERMCOSO Enterprise Risk Management links risk to strategy and performance.Enterprise RiskISO 31000ISO 31000 gives the principles, framework and process for managing risk.Enterprise Risk
Framework builder
Not on the List? Build Your Own.
Load your own framework or internal control set in the framework builder and map it to the frameworks already in Arbor.
Arbor AI
No More Memorising Clause Numbers
Arbor AI suggests the controls and frameworks that apply as you work.
See Arbor GRC with Your Own Frameworks
Bring your current risk register. We can import it from Excel during the demo, so you see your own risks in Arbor, not ours.