Links worth keeping.
Standards, regulations and references on AI agents, security and compliance. 47 public sources in 14 groups.
Official and practitioner sources side by side; the kind of each is shown. Links only: every entry goes to the publisher's own page, and no third-party files are hosted here. Filters appear when JavaScript is on.
The links
- StandardStandards
ISO/IEC 27001 — Information security management
The requirements standard for an information security management system.
- StandardStandards
ISO/IEC 42001 — AI management system
A management-system standard for organisations that build or use AI.
- FrameworkStandards
NIST Cybersecurity Framework 2.0
An outcome-based structure that maps well to other frameworks.
- RegulationRegulation
EU AI Act — Regulation (EU) 2024/1689
Official text, including application dates.
- RegulationRegulation
EU Cyber Resilience Act — Regulation (EU) 2024/2847
Official text, including reporting duties.
- RegulationRegulation
GDPR — Regulation (EU) 2016/679
The data-protection baseline; official text.
- DirectiveRegulation
NIS2 Directive — (EU) 2022/2555
Network and information security duties; official text.
- GuidanceRegulation
EDPB guidelines on the GDPR
How European regulators interpret the GDPR.
- CatalogueControls
NIST SP 800-53 — control catalogue
A reference for how controls are worded.
- CatalogueControls
CSA Cloud Controls Matrix
Cloud controls mapped to other standards.
- CatalogueControls
CIS Controls
Prioritised safeguards.
- ReportsAudit & assurance
SOC suite and trust services criteria
What SOC 1, 2 and 3 reports are and cover.
- Knowledge baseRisk & threats
MITRE ATT&CK
Adversary techniques, for scenario-based risk.
- AgencyRisk & threats
ENISA publications
Threat landscape and good-practice reports from the EU agency.
- CatalogueVulnerabilities
CISA Known Exploited Vulnerabilities
Vulnerabilities known to be exploited; a strong triage signal.
- ScoringVulnerabilities
EPSS — Exploit Prediction Scoring System
Probability of exploitation, for prioritising beyond CVSS.
- StandardSecure development
OWASP ASVS
Verifiable application security requirements.
- FrameworkSecure development
SLSA — supply-chain integrity levels
Integrity levels for software supply chains.
- FrameworkAI governance
NIST AI Risk Management Framework
Govern, Map, Measure, Manage: vendor-neutral AI risk practice.
- ReferenceAI security
OWASP Top 10 for LLM Applications
The most common security risks in LLM applications.
- Knowledge baseAI security
MITRE ATLAS
Adversary techniques against AI systems.
- StandardTooling
OSCAL — machine-readable controls
Controls and assessment results in a machine-readable format.
- CertificationCredentials
ISACA CRISC
Certified in Risk and Information Systems Control.
- PlatformThreat intelligence
MISP, the open-source threat sharing platform
Open-source platform for sharing threat indicators between organisations.
- CommunityThreat intelligence
abuse.ch
Community projects tracking malware and malicious infrastructure, with free feeds.
- CommunityThreat intelligence
AlienVault Open Threat Exchange
A community exchange of threat indicators.
- NonprofitThreat intelligence
The Shadowserver Foundation
Free reports on exposed and compromised systems.
- CommunityThreat intelligence
SANS Internet Storm Center
Daily incident-handler diaries on current internet threats.
- DirectoryThreat intelligence
OSINT Framework
A directory of free tools and sources for open-source intelligence.
- ServiceThreat intelligence
Have I Been Pwned
Check whether an address appears in known breaches.
- DatabaseVulnerabilities
National Vulnerability Database (NVD)
NIST's searchable vulnerability database, with scores.
- DatabaseVulnerabilities
The CVE Program
The shared identifier system for vulnerabilities.
- BlogPractitioners
Krebs on Security
Investigative security journalism on how real incidents unfold.
- BlogPractitioners
Schneier on Security
Long-running commentary on security, policy and technology.
- BlogPractitioners
Troy Hunt
Practical notes on breaches and web security.
- PodcastPractitioners
Risky Business
Weekly security news podcast with interviews.
- LibraryPractitioners
SANS Reading Room
Practitioner white papers on security topics.
- BlogAI security
Simon Willison's Weblog
Hands-on notes on language models, including prompt injection.
- Unofficial guideAI governance
The EU AI Act, searchable
An independent, searchable guide to the AI Act; not an official text.
- DatabaseAI governance
AI Incident Database
A public record of real-world AI failures and harms.
- ObservatoryAI governance
OECD.AI Policy Observatory
A tracker of national AI policies.
- CommunityPrivacy
IAPP
The privacy professionals' association: news and guidance.
- RegistryAudit & assurance
CSA STAR registry
A public registry of cloud providers' security assessments.
- StandardStandards
ISO/IEC 27002, information security controls
The guidance behind the Annex A controls of ISO 27001.
- StandardStandards
ISO/IEC 27701, privacy information management
An extension of ISO 27001 for managing personal data.
- CriteriaAudit & assurance
AICPA Trust Services Criteria
The criteria that SOC 2 reports are written against.
- AgencyRegulation
The European AI Office
The Commission's AI Office: AI Act guidance and updates.