Skip to content

Monthly Selected Authority Documents - February, 2020

Here is a list of the 50 most selected Authority Documents in the Common Controls Hub this past...

Here is a list of the 50 most selected Authority Documents in the Common Controls Hub this past month. We also list how many groups each Authority Document has been assigned to and how many initiatives it has been assigned to.



AD Common Name AD Type Selected Groups Initiatives
ISO 27001-2013 International or National Standard 65 157 17
NIST SP 800-53 R4 International or National Standard 37 107 10
PCI DSS Requirements and Security Assessment Procedures Contractual Obligation 32 121 10
NIST SP 800-53 R4 Moderate Impact International or National Standard 28 50 5
CIS Controls V7 Best Practice Guideline 27 12 1
NIST SP 800-53 R4 High Impact International or National Standard 27 135 5
NIST CSF 1.1 International or National Standard 25 18 2
EU General Data Protection Regulation (GDPR) Regulation or Statute 24 130 7
NIST SP 800-53 R4 Low Impact International or National Standard 22 48 5
California Consumer Privacy Act of 2018 Bill or Act 21 23 0
Sarbanes Oxley SOX Regulation or Statute 19 121 9
HIPAA Bill or Act 18 82 3
ISO/IEC 27701:2019 International or National Standard 17 3 0
AICPA Reporting on Controls at a Service Organization SOC-2 Safe Harbor 16 104 2
ISO/IEC 27002:2013(E) International or National Standard 16 126 11
NIST SP 800 66 Safe Harbor 14 7 1
Red Book (Condensed) International or National Standard 14 5 3
23 NYCRR 500 Regulation or Statute 13 3 7
CobiT Safe Harbor 12 132 1
HIPAA Electronic Health Record Technology Regulation or Statute 12 3 3
ISO 27002 International or National Standard 12 5 5
45 CFR Part 164 Regulation or Statute 11 6 3
FFIEC CAT Best Practice Guideline 11 3 1
ISO/IEC 27017:2015(E) Self-Regulatory Body Requirement 11 7 2
NIST SP 800-53 International or National Standard 11 9 1
Cloud Controls Matrix, Version 3.0 Self-Regulatory Body Requirement 10 11 1
Cloud Security Alliance CCM V1.3 Best Practice Guideline 10 8 0
FedRAMP Baseline Security Controls Audit Guideline 10 95 1
FFIEC Business Continuity Planning Handbook 2015 Audit Guideline 10 3 1
FFIEC IT Examination Handbook Audit Guideline 10 4 1
HIPAA HCFA Best Practice Guideline 10 7 0
ISO 31000 R 2009 International or National Standard 9 133 3
PCI DSS 3.0 Requirements Self-Regulatory Body Requirement 9 67 1
CSIS 20 Critical Security Controls Best Practice Guideline 8 129 1
Insurance Data Security Model Law, NAIC MDL-668 Best Practice Guideline 8 0 1
PCI DSS 3.2 SAQ D Merchant Contractual Obligation 8 3 0
Trust Services Criteria Self-Regulatory Body Requirement 8 3 1
Financial Services Sector Cybersecurity Profile International or National Standard 7 0 0
ISO/IEC 27018:2014 International or National Standard 7 4 1
ITIL Security Management Best Practice Guideline 7 2 2
MAS TRM Contractual Obligation 7 24 0
NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations International or National Standard 7 6 2
NIST SP 800-37r2 International or National Standard 7 2 1
PCI DSS 3.1 SAQ A-EP Contractual Obligation 7 0 0
PCI DSS Testing Procedures v3.2 Contractual Obligation 7 4 0
PCI SAQ A v3.1 Contractual Obligation 7 3 1
SSAE 18 Safe Harbor 7 4 1
COBIT 5 Enabling Processes: Basics Safe Harbor 6 33 2
COSO Internal Control - Integrated Framework Self-Regulatory Body Requirement 6 3 1
FFIEC Management 2015 Best Practice Guideline 6 2 1