| ISO 27001-2013 | International or National Standard | 79 | 108 | 21 |
| EU General Data Protection Regulation (GDPR) | Regulation or Statute | 46 | 71 | 4 |
| NIST SP 800-53 R4 | International or National Standard | 41 | 53 | 8 |
| AICPA Reporting on Controls at a Service Organization SOC-2 | Safe Harbor | 39 | 44 | 5 |
| PCI DSS Requirements and Security Assessment Procedures | Contractual Obligation | 38 | 77 | 9 |
| NIST SP 800-53 R4 High Impact | International or National Standard | 36 | 83 | 4 |
| NIST SP 800-53 R4 Moderate Impact | International or National Standard | 35 | 25 | 6 |
| ISO/IEC 27002:2013(E) | International or National Standard | 32 | 85 | 17 |
| NIST Cybersecurity Framework | International or National Standard | 30 | 5 | 2 |
| NIST SP 800-53 R4 Low Impact | International or National Standard | 29 | 20 | 4 |
| HIPAA | Bill or Act | 27 | 44 | 8 |
| Sarbanes Oxley SOX | Regulation or Statute | 24 | 77 | 16 |
| ISO/IEC 27017:2015(E) | Self-Regulatory Body Requirement | 23 | 1 | 0 |
| FFIEC IT Examination Handbook | Audit Guideline | 21 | 0 | 0 |
| ISO/IEC 27018:2014 | International or National Standard | 20 | 4 | 3 |
| FFIEC CAT | Best Practice Guideline | 19 | 0 | 0 |
| CobiT | Safe Harbor | 18 | 89 | 6 |
| ISO 27005 R 2011 | International or National Standard | 18 | 11 | 6 |
| NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations | International or National Standard | 18 | 1 | 2 |
| 23 NYCRR 500 | Regulation or Statute | 16 | 0 | 6 |
| NIST SP 800 66 | Safe Harbor | 16 | 8 | 5 |
| ISO 27002 | International or National Standard | 15 | 11 | 7 |
| NIST SP 800-53 | International or National Standard | 15 | 9 | 3 |
| HIPAA Electronic Health Record Technology | Regulation or Statute | 14 | 7 | 3 |
| Red Book (Condensed) | International or National Standard | 14 | 1 | 1 |
| SSAE No. 16 Reporting on Controls at a Service Organization SOC-1 | Safe Harbor | 14 | 11 | 3 |
| FedRAMP Baseline Security Controls | Audit Guideline | 13 | 41 | 5 |
| FFIEC Business Continuity Planning Handbook 2015 | Audit Guideline | 13 | 0 | 0 |
| India Indian Info Privacy Act | Regulation or Statute | 13 | 6 | 0 |
| AICPA Trust Services Principles and Criteria | Self-Regulatory Body Requirement | 12 | 4 | 1 |
| FFIEC Audit April 2012 | Best Practice Guideline | 12 | 0 | 0 |
| ISO 9001:2015 | International or National Standard | 12 | 0 | 0 |
| NIST 800-53A | International or National Standard | 12 | 6 | 3 |
| CIS 20 Critical Security Controls | Best Practice Guideline | 11 | 6 | 2 |
| Cloud Controls Matrix, Version 3.0 | Self-Regulatory Body Requirement | 11 | 6 | 1 |
| COBIT 5 Enabling Processes: Basics | Safe Harbor | 11 | 1 | 0 |
| Gramm Leach Bliley | Bill or Act | 11 | 12 | 10 |
| Australian Privacy Act 1988 | Bill or Act | 10 | 8 | 4 |
| Florida Statutes, Section 817.5681, Breach of security concerning confidential personal information in third-party possession | Regulation or Statute | 10 | 4 | 0 |
| ISO 22301- Societal Security - Business Continuity Management Systems - Requirements | International or National Standard | 10 | 3 | 1 |
| ITIL Security Management | Best Practice Guideline | 10 | 6 | 3 |
| Australia Privacy Amendment Act | Regulation or Statute | 9 | 14 | 6 |
| COSO Internal Control - Integrated Framework | Self-Regulatory Body Requirement | 9 | 0 | 0 |
| CSIS 20 Critical Security Controls | Best Practice Guideline | 9 | 82 | 4 |
| FFIEC Development Acquisition | Best Practice Guideline | 9 | 5 | 0 |
| Florida Statute ยง 501.171 Security of confidential personal information | Regulation or Statute | 9 | 0 | 0 |
| Insurance Data Security Model Law, NAIC MDL-668 | Best Practice Guideline | 9 | 0 | 0 |
| ISO 31000 R 2009 | International or National Standard | 9 | 85 | 4 |
| ITIL Service Support | Best Practice Guideline | 9 | 4 | 3 |
| MAS TRM | Contractual Obligation | 9 | 2 | 0 |
