Resources for stronger assurance.

Industry Standards

• ISO 27001

• ISO 42001: AI Information Management System

• ISO 27036: Cybersecurity - Supplier Relationships

• ISO 31000

• SOC 1

• SOC 2 (AICPA Trust Criteria)

• AIUC-1

AI

• EU AI ACT

• ISO 42001: AI Information Management System

• AIUC-1

• NIST AI Risk Management Framework

• NIST AI Risk Management Framework workbook

Regulations

• Privacy law tracker- US states

• Global privacy law tracker

• EU GDPR

• LGPD

• CRA

• EU AI ACT

• DORA

• CCPA

Cyber Risk Management

• Evidencepack.org

• SOC 2 (AICPA Trust Criteria)

• ISO 27001

• From Heatmaps to Histograms

• FAIR

• NIST CSF

Open Source Tools

• Evidence Packs: “Evidence Packs define a consistent way to package assurance evidence into a single ZIP file, so it’s easier to send, easier to review, and easier to compare over time.”

  
  

• Policy Templates: Policy templates mapped to standards such as SOC 2 & PCI by Sean Todd.

Training & Certs

• CISSP

  • CISSP Training

• CISM

• CISA

• ISO Lead Auditor

• ISO Lead Implementor

• CRISC

• GRC Engineer Cert

• TPCRA

• TPRMP

Third Party Risk

• Third Party Risk Association

• Third Party Risk Maturity Model

• Interagency Guidance on Third Party Risk

• Locktivity RegisterBetter GRC substack

• TPRM Guide Book by the TPRA

• Tom Garruba’s TPRM Tidbits on LinkedIn

Events & Organizations

• Third Party Risk Association

• ISACA

• ISSA

• ISC2

• WiCyS

• GRC Engineering Club

• GRC Meet-up

• BSides

FedRAMP

• FedRAMP.gov

• PinnR: “I created this tool to help automate all the work to help secure your org and update from versions to commit SHA’s auto-magically.” by Drew Klauser

• CISSP Study Tool by Drew Klauser.

Guides & Resources

• Third Party Risk Maturity Model

• Interagency Guidance on Third Party Risk

• NIST AI Risk Management Framework

• NIST AI Risk Management Framework workbook

• Microsoft Principals for responsible AI

• Secure Controls Framework

Privacy

• Privacy law tracker- US states

• Global privacy law tracker

• EU GDPR

• LGPD

• IAPP

• CIPP

Reads, Watches & Listens

• Locktivity Register

• Better GRC substack

• Tom Garruba’s TPRM Tidbits on LinkedIn

• GRC Engineering Podcast

• GRC Uncensored

• https://blog.stackaware.com/

• https://www.simplycyber.io/blog

Resiliency

• Global Resilience Federation

• DORA

• CRA

• Audit Caddie: Audit CADDIE is a RAG engine that automates SOC 2 gap analysis today and, fueled by community-driven templates for any regulatory framework tomorrow- by Brennan Loge.

Submit resource