Product
Everything you need to secure code, cloud, and runtime– in one central system
Code
Dependencies
Prevent open-source risks (SCA)
Secrets
Catch exposed secrets
SAST
Secure code as its written
Container Images
Secure images easily
Malware
Prevent supply chain attacks
Infrastructure as Code
Scan IaC for misconfigurations
License Risk & SBOMs
Avoid risk, be compliant
Outdated Software
Know your EOL runtimes
Cloud
Cloud / CSPM
Cloud misconfigurations
DAST
Black-box security testing
API Scanning
Test your API’s for vulns
Virtual Machines
No agents, no overhead
Kubernetes Runtime
soon
Secure your container workloads
Cloud Search
Cloud sprawl, solved
Defend
Runtime Protection
In-app Firewall / WAF
Features
AI AutoFix
1-click fixes with Aikido AI
CI/CD Security
Scan before merge and deployment
IDE Integrations
Get instant feedback while coding
On-Prem Scanner
Compliance-first local scanning
Solutions
Use Cases
Compliance
Automate SOC 2, ISO & more
Vulnerability Management
All-in-1 vuln management
Secure Your Code
Advanced code security
Generate SBOMs
1 click SCA reports
ASPM
End-to-end AppSec
CSPM
End-to-end cloud security
AI at Aikido
Let Aikido AI do the work
Block 0-Days
Block threats before impact
Industries
FinTech
HealthTech
HRTech
Legal Tech
Group Companies
Agencies
Startups
Enterprise
Mobile apps
Manufacturing
Pricing
Resources
Developer
Docs
How to use Aikido
Public API docs
Aikido developer hub
Changelog
See what shipped
Security
In-house research
Malware & CVE intelligence
Learn
Software Security Academy
Trust Center
Safe, private, compliant
Blog
The latest posts
Open Source
Aikido Intel
Malware & OSS threat feed
Zen
In-app firewall protection
OpenGrep
Code analysis engine
Integrations
IDEs
CI/CD Systems
Clouds
Git Systems
Compliance
Messengers
Task Managers
More integrations
About
About
About
Meet the team
Careers
We’re hiring
Press Kit
Download brand assets
Calendar
See you around?
Open Source
Our OSS projects
Customer Stories
Trusted by the best teams
Partner Program
Partner with us
Contact
Login
Start for Free
No CC required
Aikido
Menu
Aikido
EN
EN
FR
JP
DE
PT
Login
Start for Free
No CC required
Learn
/
Compliance Frameworks Hub

Chapter 1: Understanding Security Compliance Frameworks

Security compliance. Sounds like corporate buzzword bingo, right? Another layer of rules dreamed up by auditors to slow you down?

Honestly, sometimes it feels that way. But here’s the no-BS truth: understanding security compliance frameworks isn’t just for the legal team anymore. If you’re building software, especially in the cloud, this stuff directly impacts your code, your pipeline, and your sanity. Ignoring it can lead to hefty fines, blown customer trust, and even project shutdowns.

This chapter cuts through the jargon. We'll explain what these frameworks actually are in plain developer terms, why you should give a damn, and how they inevitably touch your day-to-day DevSecOps workflow. No fluff, just the essentials to navigate the world of security compliance without losing your mind.

Ready to make sense of the compliance beast? Let's get started.

Table of contents:
What Are Compliance Frameworks and Why Do They Matter?
How Compliance Frameworks Affect DevSecOps Workflows
Common Elements Across Frameworks

Table of contents

Chapter 1: Understanding Compliance Frameworks

What Are Compliance Frameworks and Why Do They Matter?
How Compliance Frameworks Affect DevSecOps Workflows
Common Elements Across Frameworks

Chapter 2: Major Compliance Frameworks Explained

SOC 2 Compliance
ISO 27001
ISO 27017 / 27018
NIST SP 800-53
NIST SSDF (SP 800-218)
OWASP ASVS
GDPR
NIS2 Directive
DORA
EU Cyber Resilience Act (CRA)
CMMC
PCI DSS
FedRAMP
HIPAA / HITECH
Essential Eight
Singapore CCoP (for CII)
Japan Cybersecurity Act & Related (APPI)

Chapter 3: Implementing Compliance in Development

Choosing the Right Frameworks for Your Organization
Building Compliant DevSecOps Pipelines
Training Development Teams for Compliance
Audit Preparation for Developers
Maintaining Compliance Long-Term
The End

Related blog posts

See all
See all
June 4, 2024
•
Compliance

SOC 2 certification: 5 things we learned

What we learned about SOC 2 during our audit. ISO 27001 vs. SOC 2, why Type 2 makes sense, and how SOC 2 certification is essential for US customers.

January 16, 2024
•
Compliance

NIS2: Who is affected?

Who does NIS2 apply to? Who does it affect? What are essential and important sectors and company size thresholds? Aikido's app has a NIS2 report feature.

December 5, 2023
•
Compliance

ISO 27001 certification: 8 things we learned

What we wished we'd known before starting the ISO 27001:2022 compliance process. Here are our tips for any SaaS company going for ISO 27001 certification.

Company
ProductPricingAboutCareersContactPartner with us
Resources
DocsPublic API DocsVulnerability DatabaseBlogIntegrationsGlossaryPress KitCustomer Reviews
Security
Trust CenterSecurity OverviewChange Cookie Preferences
Legal
Privacy PolicyCookie PolicyTerms of UseMaster Subscription AgreementData Processing Agreement
Use Cases
ComplianceSAST & DASTASPMVulnerability ManagementGenerate SBOMsWordPress SecuritySecure Your CodeAikido for MicrosoftAikido for AWS
Industries
For HealthTechFor MedTechFor FinTechFor SecurityTechFor LegalTechFor HRTechFor AgenciesFor EnterpriseFor PE & Group Companies
Compare
vs All Vendorsvs Snykvs Wizvs Mendvs Orca Securityvs Veracodevs GitHub Advanced Securityvs GitLab Ultimatevs Checkmarxvs Semgrepvs SonarQube
Connect
hello@aikido.dev
LinkedInX
Subscribe
Stay up to date with all updates
Not quite there yet.
👋🏻 Thank you! You’ve been subscribed.
Team Aikido
Not quite there yet.
© 2025 Aikido Security BV | BE0792914919
🇪🇺 Registered address: Coupure Rechts 88, 9000, Ghent, Belgium
🇪🇺 Office address: Gebroeders van Eyckstraat 2, 9000, Ghent, Belgium
🇺🇸 Office address: 95 Third St, 2nd Fl, San Francisco, CA 94103, US
SOC 2
Compliant
ISO 27001
Compliant