Compliance Reference Database
1200+ operational specifications from NIST 800-53, DORA, GDPR, NIS2 & CRA. Instant search, offline-capable.
Sources & Methodology
Data Sources
| Framework | Document | Version / Date | Publisher | Official URL | Verified |
|---|---|---|---|---|---|
| NIST | SP 800-53 Rev.5 + CSF 2.0 | Rev.5 Sept 2020 · CSF 2.0 Feb 2024 | NIST | csrc.nist.gov ↗ | Mar 2026 |
| DORA | Regulation (EU) 2022/2554 | Jan 2023, applicable Jan 2025 | European Parliament | eur-lex.europa.eu ↗ | Oct 2026 |
| GDPR | Regulation (EU) 2016/679 | May 2018 | European Parliament | gdpr-info.eu ↗ | Mar 2026 |
| NIS2 | Directive (EU) 2022/2555 | Jan 2023 | European Parliament | eur-lex.europa.eu ↗ | Oct 2026 |
| CRA | Regulation (EU) 2024/2847 | Nov 2024 | European Parliament | eur-lex.europa.eu ↗ | Oct 2026 |
Editorial Methodology
DORA, NIS2 and CRA article entries (one per article: 64, 46 and 71) are generated from the official EUR-Lex texts: the title and the quoted paragraphs are the law's own words, shortened, with a link to the article; only their category and criticality are editorial. The other DORA, NIS2 and CRA entries (marked Editorial) are practical guidance mapped to the cited provision; figures in them such as hours, days or review cycles are suggestions unless the cited text states them. The remaining controls were extracted from official publications, normalised into a consistent format, and categorised editorially. Cross-framework mappings (e.g. DORA to NIST, GDPR to the Swiss FADP) reflect common industry interpretations and are not official guidance from NIST, the FDPIC or any regulatory body. The Swiss FADP (nLPD / revDSG) entries cover the revised Act in force since 1 September 2023 and its Data Protection Ordinance; they were last reviewed on 2026-09-19 and carry the review date on the FADP panel. Implementation tiers for NIST controls are based on NIST CSF 2.0 maturity model guidance and represent editorial assessment, not official tier assignments.
Disclaimer
This tool is provided for informational purposes only and is currently in beta. We do not guarantee completeness, accuracy, or reliability of the data presented. Always verify details against the official source documents independently. This tool does not constitute legal or compliance advice.
Feedback
Found an error or have suggestions? Contact us ↗
🇨🇭 Swiss FADP (nLPD / revDSG) — GDPR mapping
Scope reminder: the FADP protects natural persons only — data about legal entities is no longer covered since the 2023 revision, unlike the old DPA. It applies to any processing with an effect in Switzerland. For each FADP obligation the table gives the closest GDPR article and the difference that matters (threshold, deadline, authority, scope); the same mapping appears as “Maps to” on the individual GDPR and FADP cards. Self-assess against these obligations with the FADP (nLPD) Self-Assessment; this site's own privacy notice is written under the FADP.
| FADP | Closest GDPR | Obligation | Material differences |
|---|
Tier 1 = Partial (ad hoc) → Tier 4 = Adaptive
(continuous improvement).
Source: nist.gov/cyberframework
📊 Assess My Organisation — NIST CSF 2.0
Select your current implementation tier for each CSF function. Nothing is sent to any server; tick “Keep my progress in this browser” below the results to have it survive a reload, or export it as an encrypted file.