Product Solutions Platform Insights Pricing Book a demo

40+ frameworks. One control set.

Every framework below is curated, versioned and cross-mapped in the catalog today, from the universal core to the market regimes of nine African jurisdictions: 1,200+ requirements resolving to 132 shared controls. Implement once; it counts everywhere it maps.

The universal core

The standards regulated organisations anchor on, whatever the industry: one control set, audited many ways.

ISO 27001

The anchor standard for information security: an auditable management system, not a checklist.

SOC 2

The attestation enterprise buyers ask for: your controls, tested by an auditor, over a period.

NIST CSF 2.0

Six functions, one shared vocabulary: how boards, regulators and security teams talk about cyber risk.

ISO 22301

Continuity you can prove: impact analysis, recovery objectives and tested plans, not a binder on a shelf.

ISO 27701

The privacy management standard: what turns a security ISMS into certifiable privacy governance.

Conditional standards

The ones that apply when they apply to you: card data, AI systems, European data subjects and financial entities, cloud estates, SWIFT connections, mobile money. Named as conditional, because a CCO knows the difference.

PCI DSS v4.0

The card-data standard: twelve requirements that apply when, and only when, you touch cardholder data.

ISO 42001

Management-system discipline for AI: applies when models make decisions you answer for.

GDPR

The EU privacy regulation: applies the moment your processing reaches European data subjects.

ISO 27017

Cloud security made auditable: who controls what, provider or customer, stated and evidenced.

ISO 27018

The public-cloud privacy code: PII processor duties made concrete for cloud operations.

DORA

The EU's operational-resilience regime: five pillars from ICT risk to threat-led testing.

SWIFT CSP

The controls behind your SWIFT connection: attested annually, assessed independently, seen by counterparties.

GSMA Mobile Money Certification

The mobile-money trust mark: safeguarding funds, fighting financial crime, treating customers fairly.

HIPAA

The US health-privacy regime: three rules that follow protected health information wherever it goes.

The market regimes

The depth where US- and EU-built tools stop, market by market: Nigeria first, then South Africa, Kenya, Ghana, Egypt and the regional instruments, curated and kept current.

Nigeria12

CBN AML/CFT/CPF

The supervisory core of Nigerian financial crime compliance: due diligence, monitoring and reporting.

CBN Automated-AML Baseline

The glass-box mandate: automated AML must be governed, explainable and demonstrably effective.

CBN Three-tier KYC

Proportionate KYC across three tiers: financial inclusion without losing the risk discipline.

CBN Cybersecurity Framework

The CBN's cyber mandate: named accountability, risk-based controls and a self-assessment you file.

NDPA 2023

Nigeria's data-protection law: every organisation that touches personal data answers to it.

NDPR

The regulation that preceded the Act: still referenced, still audited against, curated for continuity.

NFIU Reporting

The reporting spine of Nigerian AML: suspicious and threshold reports, filed on time, every time.

MLPPA 2022

The federal AML statute: the criminal-law floor under every CBN circular and NFIU filing.

TPPA 2022

Counter-terrorist financing in statute: screening, freezing and reporting without delay.

NSBP

Governance of ESG obligations, Nigerian edition: nine principles from E&S risk to CBN-filed reporting.

SEC VASP Rules

Nigeria's digital-asset rulebook: registration, custody, AML and disclosure for VASPs.

NDIC Obligations

The deposit-insurance duties: premiums, returns and the cooperation a payout depends on.

South Africa3

POPIA

South Africa's data-protection law: eight conditions for lawful processing, and a regulator that uses them.

FICA

South Africa's AML statute: the RMCP, the CDD chain, and reporting into the FIC.

SARB Joint Standard 2

South Africa's cyber mandate for financial institutions: governance to testing, with the regulators notified.

Kenya2

Kenya DPA 2019

Kenya's data-protection law: registration, GDPR-shaped rights, and a commissioner who enforces.

CBK Cybersecurity Guidance

The CBK's cyber mandate: board-owned governance, a named CISO, and incidents reported within 24 hours.

Ghana2

Ghana DPA 2012

West Africa's pioneer data-protection act: registration, principles and security duties under the DPC.

BoG Cyber Directive

Ghana's supervisory cyber regime: CISO, programme, SOC capability and reporting into the BoG.

Egypt2

Egypt PDPL

Egypt's data-protection law: a licence-and-permit regime with a mandatory DPO and 72-hour breach duty.

CBE AML/KYC

Egyptian financial-crime supervision: the KYC chain, monitoring and STRs through the EMLCU.

Morocco1

Morocco Law 09-08

Morocco's data-protection law: the CNDP's declaration and authorisation regime.

Rwanda1

Rwanda DPL

Rwanda's data law: NCSA registration, a 48-hour breach clock, and data stored in Rwanda by default.

Tanzania1

Tanzania PDPA

Tanzania's data-protection act: registration with the new commission, principles and rights enforced.

Uganda1

Uganda DPPA

Uganda's privacy act: PDPO registration and a breach duty that reads 'immediately'.

Regional & continental3

West Africa (WAEMU)

BCEAO Uniform AML Law

One AML law, eight countries: the WAEMU uniform regime from Senegal to Guinea-Bissau.

West Africa (ECOWAS)

ECOWAS Data Protection Act

The regional privacy floor: the 2010 Supplementary Act West Africa's national laws are built on.

AU Malabo Convention

The continental convention: data protection and cybersecurity in one instrument, in force since 2023.

Curation continues

The catalog grows through the same reviewed pipeline that keeps it current. Next through it:

CBN Corporate GovernanceBOFIA 2020Cybercrimes ActOpen BankingPrudential / BaselNIST 800-53ISO 31000ISSB (IFRS S1/S2)COBITCOSOFRC Code

Compliance you can prove.
Walk into your next audit ready.

Book a working demo. We'll map your obligations to the standards you're audited against and the regulators you actually answer to.

Book a demo See the architecture

The platform, modules, catalog, audit trail and security architecture are live today; the continuous live-evidence engine is in active development, shown in a working demo. Reach us at hello@cardinalgrc.com.