A Complete Reference Guide to Software Engineering, Automotive SPICE, Cybersecurity, AI Governance, IT Service Management, Business Excellence, Quality Management and Organizational Maturity
Introduction
Modern organizations rely on industry standards, engineering frameworks, maturity models, and management methodologies to improve quality, strengthen cybersecurity, manage risks, meet regulatory expectations, and deliver reliable products and services.
From Automotive SPICE (ASPICE), CMMI, and ISO 9001 to NIST Cybersecurity Framework, ISO 26262, ISO/IEC 42001, and ITIL, each provides a different approach to solving organizational and technical challenges.
However, understanding which standard applies to which business process can be overwhelming.
This guide brings together 170 important standards, frameworks, maturity models, guidelines, and engineering methodologies, organized by industry and explained in simple, one-line descriptions.
It is designed for software engineers, quality assurance professionals, cybersecurity specialists, automotive engineers, DevOps practitioners, IT managers, auditors, compliance teams, project managers, business leaders, and anyone working toward organizational excellence.
Important distinction: Not every entry is a maturity model or certifiable standard. This catalogue intentionally includes management system standards, process assessment models, engineering standards, methodologies, assessment schemes, and selected regulations. Some entries represent standard families or related methodologies rather than individual publications.
1. Software Process Improvement, Capability and Testing Maturity
Software engineering frameworks help organizations establish repeatable processes, improve development quality, measure capabilities, and continuously enhance software delivery.
1. Automotive SPICE (ASPICE) — A process assessment model used in the automotive industry to evaluate and improve system and software development capabilities.
2. SPICE (Software Process Improvement and Capability Determination) — A process assessment approach for evaluating organizational processes and identifying improvement opportunities.
3. CMMI (Capability Maturity Model Integration) — A capability and maturity improvement model that helps organizations strengthen processes, performance, predictability, and quality.
4. ISO/IEC 330xx — A family of international standards defining principles, requirements, and methods for process assessment and capability determination.
5. ISO/IEC 15504 — The legacy SPICE process assessment standards, largely superseded by the ISO/IEC 330xx family.
6. Automotive SPICE for Cybersecurity — An extension of Automotive SPICE incorporating cybersecurity engineering processes into automotive process capability assessments.
7. MDevSPICE (Medical Device SPICE) — A process assessment model designed to evaluate medical device software development practices against relevant lifecycle and regulatory expectations.
8. TMMi (Test Maturity Model Integration) — A five-level maturity model for systematically improving software testing processes and organizational testing capabilities.
9. TPI NEXT (Test Process Improvement NEXT) — A structured approach for evaluating testing practices and prioritizing practical test process improvements.
10. IT-CMF (IT Capability Maturity Framework) — A capability maturity framework for assessing and improving IT management, performance, business value, and digital transformation.
11. ISO/IEC/IEEE 29119 — An international software testing standards family covering testing concepts, processes, documentation, techniques, and related practices.
12. ISO/IEC 25010:2023 — A software and ICT product quality model defining nine quality characteristics used to specify, evaluate, and improve product quality.
13. ISO/IEC/IEEE 730 — A software quality assurance standard providing guidance for planning, implementing, and managing software quality assurance processes.
14. Six Sigma — A data-driven process improvement methodology focused on reducing variation, minimizing defects, and improving operational performance.
15. CISQ (Consortium for Information & Software Quality) — An industry initiative establishing automated measures and standards for software structural quality, security, reliability, and maintainability.
2. Automotive, Functional Safety and Safety-Critical Engineering
Safety-critical engineering standards help organizations develop systems where software or hardware failures could create significant risks to human safety, equipment, or the environment.
16. ISO 26262 — The international functional safety standard for road vehicles, covering safety management, engineering, verification, and validation throughout the automotive lifecycle.
17. ISO/SAE 21434 — An automotive cybersecurity engineering standard addressing cybersecurity risk management across vehicle development, production, operation, and post-development activities.
18. IEC 61508 — A foundational functional safety standard for electrical, electronic, and programmable electronic safety-related systems across industrial sectors.
19. DO-178C — An aviation software development assurance standard used to support approval of safety-critical airborne software.
20. DO-254 — An aviation development assurance standard for airborne electronic hardware, including complex hardware used in safety-critical aircraft systems.
21. IEC 62304 — A medical device software lifecycle standard establishing requirements for software development, maintenance, and risk-related activities.
22. ISO 13485 — A quality management system standard designed for organizations developing, manufacturing, or supplying medical devices and related services.
23. EN 50128 — A legacy railway software safety standard covering software development for railway control and protection systems, superseded by EN 50716.
24. ISO/IEC/IEEE 12207 — An international standard defining software lifecycle processes from acquisition and development through operation, maintenance, and disposal.
25. ISO/IEC/IEEE 15288 — A systems engineering standard defining processes for managing complex systems throughout their complete lifecycle.
26. ISO/IEC 29110 — A standards family providing simplified systems and software engineering lifecycle guidance tailored to very small entities.
27. SPICE for Space — A space-sector process assessment approach applying SPICE principles to evaluate and improve space software engineering capabilities.
3. Cybersecurity, Information Security and AI Management
Cybersecurity frameworks provide structured approaches to protecting digital assets, managing security risks, securing infrastructure, and strengthening organizational resilience.
28. ISO/IEC 27001 — An international standard specifying requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).
29. NIST Cybersecurity Framework (CSF) — A cybersecurity risk management framework organized around Govern, Identify, Protect, Detect, Respond, and Recover functions.
30. NIST SP 800-53 — A comprehensive catalogue of security and privacy controls used to protect information systems and organizations.
31. SOC 2 (System and Organization Controls 2) — An independent attestation reporting framework evaluating service organization controls against the AICPA Trust Services Criteria.
32. PCI DSS (Payment Card Industry Data Security Standard) — A security standard defining requirements for protecting payment account data and securing cardholder data environments.
33. IEC 62443 — A series of industrial cybersecurity standards addressing security requirements for industrial automation and control systems.
34. CMMC (Cybersecurity Maturity Model Certification) — A US Department of Defense program assessing contractor cybersecurity practices for protecting federal contract information and controlled unclassified information.
35. ISO/IEC 42001 — The international management system standard for governing artificial intelligence activities, managing AI-related risks, and supporting responsible AI deployment.
4. IT Service Management, Enterprise Governance and Risk Management
IT governance and service management frameworks help organizations align technology services with business objectives while maintaining quality, accountability, and operational resilience.
36. ITIL (Information Technology Infrastructure Library) — A widely adopted framework of service management principles and practices for delivering and improving technology-enabled services.
37. COBIT (Control Objectives for Information and Related Technology) — An enterprise governance and management framework for aligning information and technology with business objectives.
38. ISO/IEC 20000-1 — An international standard specifying requirements for establishing, operating, maintaining, and improving an IT service management system.
39. FitSM — A lightweight IT service management standards family designed to help organizations implement practical and streamlined service management processes.
40. VeriSM — A service management approach combining governance, emerging technologies, organizational capabilities, and management practices for digital services.
41. ISO 22301 — An international standard defining requirements for business continuity management systems and organizational preparedness for disruptive incidents.
42. ISO 31000 — An international risk management guideline providing principles, a framework, and processes for identifying and managing organizational risks.
5. Business Excellence, Organizational Maturity and Continuous Improvement
Business excellence frameworks help organizations improve performance, develop organizational capabilities, optimize processes, and establish cultures of continuous improvement.
43. EFQM Model (European Foundation for Quality Management) — An organizational excellence framework for assessing strategic direction, execution, stakeholder value, and sustainable performance.
44. Baldrige Excellence Framework — A performance excellence framework helping organizations evaluate leadership, strategy, customers, workforce, operations, and results.
45. Lean Management — A management philosophy focused on maximizing customer value while minimizing waste, delays, and unnecessary activities.
46. Kaizen — A continuous improvement philosophy emphasizing frequent, incremental changes driven by employee involvement and systematic problem-solving.
47. BPMM (Business Process Maturity Model) — A maturity model for evaluating and improving the predictability, consistency, and effectiveness of organizational business processes.
48. OPM3 (Organizational Project Management Maturity Model) — A PMI-developed maturity model for evaluating organizational project management capabilities and alignment with strategic goals.
49. P3M3 (Portfolio, Programme and Project Management Maturity Model) — A maturity assessment model for evaluating portfolio, programme, and project management capabilities across organizations.
50. People CMM (People Capability Maturity Model) — A maturity model for systematically improving workforce development, competency management, and people-related organizational practices.
51. DMM (Data Management Maturity Model) — A capability maturity model for assessing and improving enterprise data governance, management, quality, and operational practices.
6. Quality, Environmental, Energy, Resilience and IT Governance Standards
Management system standards provide organizations with structured requirements and guidance for managing quality, environmental responsibilities, workplace safety, energy performance, and governance.
52. ISO 9001:2026 — An international quality management system standard helping organizations consistently meet customer requirements and continuously improve operational performance.
53. ISO 14001 — An environmental management system standard helping organizations manage environmental responsibilities, reduce impacts, and improve environmental performance.
54. ISO 45001 — An occupational health and safety management system standard focused on preventing work-related injuries, illnesses, and hazardous workplace conditions.
55. ISO 50001 — An energy management system standard helping organizations systematically improve energy efficiency, energy performance, and energy-related operational management.
56. ISO 22316 — An international guideline providing principles and attributes for strengthening organizational resilience and adaptability.
57. ISO/IEC 38500 — An international governance standard providing principles for the effective, efficient, and acceptable use of information technology within organizations.
58. ISO/IEC 27701:2025 — An international standard establishing requirements and guidance for implementing and improving a Privacy Information Management System.
59. ISO/IEC 38505 Series — A set of governance standards providing guidance on the organizational governance of data and its responsible use.
7. Secure Software Development, Application Security and Agile Frameworks
These frameworks focus on secure software engineering, application security maturity, vulnerability prevention, and adaptive software delivery practices.
60. NIST SP 800-218 (Secure Software Development Framework) — A secure software development framework providing practices to reduce vulnerabilities and improve software supply-chain security.
61. OWASP SAMM (Software Assurance Maturity Model) — An open-source model for assessing and improving software security practices across the development lifecycle.
62. BSIMM (Building Security In Maturity Model) — An observational software security model that benchmarks real-world security practices across participating organizations.
63. OWASP ASVS (Application Security Verification Standard) — A structured standard defining security verification requirements for assessing and testing web applications and services.
64. OWASP MASVS (Mobile Application Security Verification Standard) — A mobile application security standard defining requirements for secure mobile application design, development, and verification.
65. SAFe (Scaled Agile Framework) — An enterprise agile framework for coordinating agile teams, portfolios, business objectives, and large-scale software delivery.
66. Scrum — A lightweight agile framework for delivering complex products through iterative development, clear accountabilities, and continuous inspection and adaptation.
67. Kanban Method — A workflow management method focused on visualizing work, limiting work in progress, improving flow, and supporting evolutionary change.
68. ISO/IEC 38507 — A governance guideline examining how artificial intelligence affects organizational leadership, accountability, decision-making, and oversight.
69. ISO/IEC 23894 — An international guideline for identifying, assessing, treating, and monitoring risks associated with artificial intelligence systems.
8. Cloud Security, Healthcare Security, IT Assets and Project Management
These standards address cloud protection, healthcare information security, technology asset management, project quality, and structured project delivery.
70. ISO/IEC 27017 — A cloud security guidance standard providing additional information security controls and implementation guidance for cloud service providers and customers.
71. ISO/IEC 27018 — A cloud privacy standard addressing the protection of personally identifiable information processed in public cloud environments.
72. ISO/IEC 27799 — A health informatics security standard providing guidance for managing information security in healthcare organizations.
73. ISO/IEC 19770 Series — A family of international standards for IT asset management, including software asset management, identification, and entitlement information.
74. ISO 10006 — A quality management guideline providing practices for managing quality throughout project planning, execution, and completion.
75. ISO 21502 — An international project management guideline defining concepts and practices for initiating, planning, managing, controlling, and closing projects.
76. PRINCE2 (Projects IN Controlled Environments) — A structured project management method emphasizing business justification, defined roles, project stages, governance, and controlled delivery.
9. Requirements Engineering, Architecture and Advanced Software Quality
Engineering standards in this category support requirements traceability, architecture consistency, verification, technical documentation, and objective software quality measurements.
77. ISO/IEC/IEEE 29148 — An international requirements engineering standard covering stakeholder needs, system and software requirements, specifications, and traceability.
78. ISO/IEC/IEEE 42010 — A standard providing requirements and guidance for describing and communicating system, software, and enterprise architectures.
79. ISO/IEC/IEEE 15289 — A lifecycle documentation standard defining the purpose and content of information items produced during systems and software engineering.
80. IEEE 1012-2024 — A verification and validation standard defining practices for evaluating whether systems, software, and hardware satisfy requirements and intended uses.
81. ISO/IEC/IEEE 15939 — An international measurement process standard supporting the definition, collection, analysis, and interpretation of engineering performance metrics.
82. ISO/IEC 5055 — A source-code quality measurement standard defining automated measures for evaluating structural software quality and identifying critical weaknesses.
83. ISO/IEC 25023 — A product quality measurement standard defining measures used to evaluate software and system quality characteristics.
84. ISO/IEC 25040:2024 — A quality evaluation framework providing guidance and requirements for evaluating ICT products, software, data, and IT services.
85. ISO/IEC/IEEE 24748-1 — A lifecycle management guideline supporting the effective application and integration of systems and software lifecycle processes.
10. Advanced Automotive, Railway, Aerospace, Medical Device and Industrial Standards
These additional industry-specific standards strengthen engineering quality, functional safety, cybersecurity, supplier assurance, system validation, and regulatory compliance.
86. IATF 16949 — An automotive quality management system standard establishing sector-specific requirements for quality, defect prevention, and continual improvement throughout automotive supply chains.
87. VDA 6.3 — An automotive process audit methodology used to evaluate product development, production processes, supplier capabilities, and process-related risks.
88. Automotive Core Tools (APQP, Control Plan, PPAP, FMEA, MSA, SPC) — A collection of automotive quality planning, risk prevention, measurement, process control, and product approval methods.
89. ISO 21448 (SOTIF) — An automotive safety standard addressing hazards caused by functional insufficiencies and reasonably foreseeable misuse without requiring component malfunction.
90. ISO 24089 — An automotive software update engineering standard defining processes for planning, developing, verifying, validating, and managing vehicle software updates.
91. UNECE UN Regulation No. 155 (UN R155) — A vehicle cybersecurity regulation establishing requirements for cybersecurity management systems and vehicle cybersecurity approval.
92. UNECE UN Regulation No. 156 (UN R156) — A vehicle software update regulation establishing requirements for software update management systems and software update approval.
93. ISO/PAS 8800 — An automotive engineering specification addressing safety-related risks and assurance practices associated with artificial intelligence in road vehicles.
94. ISO/TS 5083 — A technical specification addressing safety engineering, design, verification, and validation for automated driving systems.
95. ISO 34502 — An automotive standard providing a scenario-based safety evaluation framework for automated driving systems.
96. ISO 34503 — An automotive standard defining how to specify an automated driving system’s operational design domain and operating conditions.
97. EN 50716 — A railway software development standard establishing process and technical requirements for railway software, replacing EN 50128 and EN 50657.
98. EN 50126 — A railway standard family addressing reliability, availability, maintainability, and safety throughout railway system lifecycles.
99. EN 50129 — A railway safety standard establishing requirements for safety-related electronic systems used in signalling applications.
100. ISO 14971 — A medical device risk management standard defining processes for identifying hazards, evaluating risks, implementing controls, and monitoring effectiveness.
101. IEC 62366-1 — A medical device usability engineering standard focusing on reducing risks associated with user interaction and use-related errors.
102. IEC 81001-5-1 — A health software security standard defining secure product lifecycle activities for health software and health IT systems.
103. IEC 82304-1 — A health software product standard defining requirements for product safety, security, and lifecycle management.
104. IEC 61511 — A functional safety standard covering safety-instrumented systems used in the process industry sector.
105. IEC 62061 — A machinery functional safety standard addressing the design, integration, and validation of safety-related control systems.
106. SAE ARP4754B — An aerospace guideline defining development assurance processes for aircraft and systems, including requirements management and verification.
107. SAE ARP4761A — An aerospace guideline providing safety assessment methods for identifying hazards and evaluating aircraft system safety risks.
108. RTCA DO-326A / EUROCAE ED-202A — Airworthiness security guidance addressing cybersecurity risk management and assurance for aircraft systems.
109. ECSS-E-ST-40C Rev.1 — A European space engineering standard defining software development requirements for space systems and related ground infrastructure.
110. ECSS-Q-ST-80C Rev.2 — A European space product assurance standard defining software product assurance and quality-related activities for space projects.
111. AS9100 / IAQG 9100 — An aerospace quality management system standard supplementing ISO 9001 with aerospace and defense industry requirements.
112. AIAG CQI-34 (Software Assurance Approval Process / SwAAP) — An automotive industry manual establishing a structured approach to software quality assurance, supplier collaboration, and software approval.
11. Advanced Cybersecurity, Privacy, Cloud and Software Supply-Chain Security
This category brings together technical security controls, cybersecurity risk management guidance, secure configuration standards, and software supply-chain assurance frameworks.
113. ISO/IEC 27002 — An international information security standard providing implementation guidance for organizational, people, physical, and technological security controls.
114. ISO/IEC 27005 — An information security risk management guideline supporting risk identification, analysis, evaluation, treatment, and monitoring.
115. ISO/IEC 27035 Series — A family of information security incident management standards addressing incident preparation, detection, assessment, response, and organizational learning.
116. ISO/IEC 27036 Series — A set of standards providing guidance for managing information security risks across supplier and supply-chain relationships.
117. ISO/IEC 27031:2025 — A standard providing guidance for preparing information and communication technology to support business continuity.
118. ISO/IEC 27034 Series — An application security standards family supporting the integration of security into application development and management processes.
119. ISO/IEC 29147 — A vulnerability disclosure standard defining guidelines for receiving, coordinating, and communicating vulnerability information.
120. ISO/IEC 30111 — A vulnerability handling standard providing guidelines for analyzing, remediating, and coordinating reported product vulnerabilities.
121. ISO/IEC 15408 (Common Criteria) — An international framework for specifying and independently evaluating the security properties of IT products.
122. ISO/IEC 29100 — A privacy framework defining privacy principles, terminology, and a structured approach to protecting personally identifiable information.
123. ISO/IEC 29134 — A privacy impact assessment guideline for identifying and managing privacy risks associated with information systems and processing activities.
124. NIST SP 800-37 (Risk Management Framework) — A structured risk management process for categorizing systems, selecting controls, assessing security, authorizing systems, and monitoring risks.
125. NIST SP 800-61 Rev.3 — Cybersecurity incident response guidance integrated with the NIST Cybersecurity Framework and organizational cybersecurity risk management.
126. NIST SP 800-207 (Zero Trust Architecture) — A cybersecurity architecture guideline emphasizing continuous verification, least-privilege access, and reduced reliance on network location.
127. NIST SP 800-161 Rev.1 — Cybersecurity supply-chain risk management guidance for identifying, assessing, and reducing risks associated with suppliers, products, and services.
128. NIST SP 800-171 Rev.3 — Security requirements for protecting controlled unclassified information in nonfederal systems and organizations.
129. CIS Critical Security Controls v8.1 — A prioritized set of actionable cybersecurity safeguards designed to reduce common attack risks.
130. CIS Benchmarks — Community-developed secure configuration guidelines for operating systems, cloud services, applications, databases, and infrastructure technologies.
131. CSA Cloud Controls Matrix (CCM) — A cloud security control framework supporting cloud risk management, compliance assessments, and shared-responsibility evaluation.
132. NIST Privacy Framework — A voluntary privacy risk management framework helping organizations identify and manage privacy risks associated with data processing.
133. MITRE ATT&CK — A knowledge base of real-world adversary tactics and techniques used for threat modeling, detection engineering, and security assessment.
134. OWASP Top 10:2025 — A security awareness reference identifying major categories of risks affecting modern web applications.
135. OWASP API Security Top 10 — A security reference identifying major risks affecting application programming interfaces, including authorization and authentication weaknesses.
136. SLSA (Supply-chain Levels for Software Artifacts) — A framework defining progressive levels of assurance for software build integrity, provenance, and supply-chain protection.
137. OpenSSF OSPS Baseline — A set of open-source project security requirements organized by maturity level to support secure development and maintenance practices.
138. TISAX / VDA ISA — An automotive information security assessment and assurance scheme used by industry partners to evaluate and exchange supplier security assessment results.
12. Artificial Intelligence Governance, AI Risk Management and Data Maturity
AI governance and data management frameworks help organizations develop trustworthy AI systems, manage AI risks, improve data quality, and establish responsible governance practices.
139. NIST AI Risk Management Framework (AI RMF) — A voluntary framework for identifying, measuring, managing, and governing risks associated with artificial intelligence systems.
140. NIST AI 600-1 (Generative AI Profile) — A companion profile to the NIST AI RMF addressing risks and risk management considerations specific to generative AI.
141. ISO/IEC 42005 — An international guideline for conducting AI system impact assessments and documenting potential effects on individuals, groups, and society.
142. ISO/IEC 42006 — A standard establishing additional requirements for bodies that audit and certify artificial intelligence management systems.
143. ISO/IEC 5338 — An AI system lifecycle standard defining processes for developing, operating, maintaining, and managing AI-enabled systems.
144. ISO/IEC 22989 — An international standard defining foundational artificial intelligence terminology, concepts, and classifications.
145. ISO/IEC 23053 — A framework describing AI systems that use machine learning, including system components, interactions, and lifecycle considerations.
146. ISO/IEC 5259 Series — A standards family addressing data quality management and measurement for analytics and machine learning applications.
147. ISO/IEC 25059 — An AI system quality model defining characteristics used to specify and evaluate artificial intelligence system quality.
148. ISO/IEC 25012 — A data quality model defining characteristics used to evaluate the quality of data within information systems.
149. DAMA-DMBOK (Data Management Body of Knowledge) — A comprehensive reference framework covering data governance, architecture, quality, security, integration, and other data management disciplines.
150. EDM Council DCAM (Data Management Capability Assessment Model) — A capability assessment framework for evaluating enterprise data management maturity, governance, architecture, controls, and operational capabilities.
151. EDM Council CDMC (Cloud Data Management Capabilities) — A framework defining essential controls and capabilities for managing and protecting data in cloud environments.
152. OWASP Top 10 for LLM / Generative AI Applications — A security risk reference highlighting common vulnerabilities and weaknesses in applications powered by large language models.
13. Enterprise Architecture, Project Management, DevOps and Cloud Financial Management
Enterprise technology and project management frameworks help organizations align architecture, technology investment, project delivery, operational reliability, and business outcomes.
153. TOGAF Standard, 10th Edition — An enterprise architecture framework providing methods, structures, and governance practices for designing and evolving enterprise architectures.
154. ArchiMate — An enterprise architecture modeling language used to represent business processes, applications, technologies, relationships, and architectural changes.
155. IT4IT Reference Architecture — A reference architecture for managing IT value streams, digital products, service delivery, and technology operating models.
156. PMBOK Guide, Eighth Edition — PMI’s project management body of knowledge providing principles, performance domains, and practices for delivering successful projects.
157. ISO 21503 — An international guideline providing concepts and practices for effective programme management.
158. ISO 21504 — An international guideline providing principles and practices for managing portfolios of projects and programmes.
159. FinOps Framework — A technology financial management framework helping finance, engineering, and business teams optimize cloud and other technology spending.
160. Site Reliability Engineering (SRE) — An engineering discipline applying software practices, service-level objectives, automation, and operational measurement to improve system reliability.
161. DORA Software Delivery Performance Metrics — Research-based software delivery performance measures used to evaluate delivery throughput, stability, and engineering improvement.
14. Advanced Quality Auditing, Compliance, Sustainability and Asset Management
These standards provide guidance for assessing management systems, strengthening compliance, improving organizational sustainability, and managing critical assets.
162. ISO 19011:2026 — An international guideline providing principles and practices for management system auditing, audit programme management, and auditor competence.
163. ISO 9004 — A quality management guideline focused on sustained organizational success, performance improvement, and long-term value creation.
164. IEC 31010 — An international standard providing techniques for assessing and analyzing risks across different organizational activities and industries.
165. ISO 37301 — A compliance management system standard establishing requirements for developing, implementing, maintaining, and improving organizational compliance programmes.
166. ISO 37001 — An anti-bribery management system standard providing requirements for preventing, detecting, and responding to bribery risks.
167. ISO/TS 22317 — A business continuity guideline providing a structured approach to conducting business impact analysis.
168. ISO 22361 — A crisis management guideline helping organizations prepare for, respond to, and learn from major crises.
169. ISO 55001 — An asset management system standard defining requirements for managing asset value, performance, risks, and lifecycle activities.
170. ISO 14064-1 — An international standard providing requirements and guidance for quantifying and reporting organizational greenhouse gas emissions and removals.
How to Use These 170 Standards and Frameworks
Organizations should not attempt to implement every framework in this catalogue.
Instead, they should identify the standards and methodologies most relevant to their industry, regulatory obligations, business objectives, product risks, and organizational maturity.
For example, an automotive software organization might prioritize ASPICE, ISO 26262, ISO/SAE 21434, ISO 21448, ISO 24089, and IATF 16949.
A software product company might focus on CMMI, ISO/IEC/IEEE 12207, ISO/IEC 25010, ISO/IEC 27001, NIST SSDF, OWASP SAMM, and relevant DevOps practices.
A healthcare technology provider might prioritize IEC 62304, ISO 13485, ISO 14971, IEC 62366-1, and applicable information security and privacy standards.
An AI-focused organization might prioritize ISO/IEC 42001, ISO/IEC 23894, NIST AI RMF, ISO/IEC 42005, ISO/IEC 5338, and relevant data governance frameworks.
The objective is not simply to adopt more standards, but to build processes that are practical, measurable, efficient, secure, and continuously improving.
Understanding Standards, Frameworks, and Maturity Models
Although these terms are frequently used interchangeably, they represent different concepts.
Standards establish agreed requirements, specifications, or guidance for particular activities, systems, or management practices.
Frameworks provide organized structures, principles, practices, or reference models for addressing particular challenges.
Maturity models assess how systematically and effectively an organization performs activities and improves organizational capabilities.
Methodologies define approaches, principles, techniques, and practices for performing work or improving outcomes.
Regulations establish legal or regulatory obligations within specified jurisdictions and scopes.
Some standards support formal certification or conformity assessment, while others provide voluntary guidance. A maturity assessment is not automatically equivalent to certification or regulatory compliance.
Official References and Further Reading
Readers should consult the official publishers for complete requirements, edition status, licensing, and implementation details.
- International Organization for Standardization (ISO)
- ISO 9001:2026
- ISO 19011:2026
- ISO/IEC 27701:2025
- NIST Cybersecurity Framework
- OWASP Top 10:2025
- OpenSSF OSPS Baseline
- Project Management Institute
- Automotive Industry Action Group (AIAG)
- The Open Group
This catalogue is a high-level educational reference rather than a substitute for the published standards or applicable regulatory requirements. Standard editions and certification rules should be verified before implementation.
Conclusion
The 170 standards, frameworks, maturity models, and methodologies covered in this guide represent an extensive cross-industry reference for engineering quality, software development, cybersecurity, artificial intelligence, business excellence, project management, and organizational governance.
Understanding how these approaches relate to one another helps organizations identify capability gaps, reduce operational and technical risks, improve delivery practices, and establish structured improvement programmes.
The ultimate goal is not certification for its own sake, but building organizations that deliver consistent quality, manage risk effectively, adapt to technological change, and achieve sustainable performance.
Whether you are beginning with ISO 9001, implementing ASPICE, adopting CMMI, building a secure development lifecycle, or establishing AI governance, the right combination of standards and practical engineering practices can provide a foundation for long-term success.
I’m Rajesh Kumar, a DevOps, SRE, DevSecOps, Cloud, and Platform Engineering expert passionate about sharing practical knowledge, real-world experiences, and industry best practices. I have worked at Cotocus and regularly write about technology, travel, investing, health, product reviews, and digital marketing through my various platforms.
I publish technical articles at DevOps School, travel stories at Holiday Landmark, stock market insights at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at TrueReviewNow, and SEO and digital marketing strategies at Wizbrand.
Find Trusted Cardiac Hospitals
Compare heart hospitals by city and services — all in one place.
Explore Hospitals