{"id":79610,"date":"2026-10-28T08:12:07","date_gmt":"2026-10-28T08:12:07","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=79610"},"modified":"2026-10-28T08:14:13","modified_gmt":"2026-10-28T08:14:13","slug":"essential-industry-standards-frameworks-maturity-models-and-methodologies-explained","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/essential-industry-standards-frameworks-maturity-models-and-methodologies-explained\/","title":{"rendered":"Essential Industry Standards, Frameworks, Maturity Models and Methodologies Explained"},"content":{"rendered":"\n

A Complete Reference Guide to Software Engineering, Automotive SPICE, Cybersecurity, AI Governance, IT Service Management, Business Excellence, Quality Management and Organizational Maturity<\/strong><\/p>\n\n\n\n

\n\n\n\n

Introduction<\/h2>\n\n\n\n

Modern organizations rely on industry standards, engineering frameworks, maturity models, and management methodologies to improve quality, strengthen cybersecurity, manage risks, meet regulatory expectations, and deliver reliable products and services.<\/p>\n\n\n\n

From Automotive SPICE (ASPICE), CMMI, and ISO 9001 to NIST Cybersecurity Framework, ISO 26262, ISO\/IEC 42001, and ITIL, each provides a different approach to solving organizational and technical challenges.<\/p>\n\n\n\n

However, understanding which standard applies to which business process can be overwhelming.<\/p>\n\n\n\n

This guide brings together 170 important standards, frameworks, maturity models, guidelines, and engineering methodologies<\/strong>, organized by industry and explained in simple, one-line descriptions.<\/p>\n\n\n\n

It is designed for software engineers, quality assurance professionals, cybersecurity specialists, automotive engineers, DevOps practitioners, IT managers, auditors, compliance teams, project managers, business leaders, and anyone working toward organizational excellence.<\/p>\n\n\n\n

Important distinction:<\/strong> Not every entry is a maturity model or certifiable standard. This catalogue intentionally includes management system standards, process assessment models, engineering standards, methodologies, assessment schemes, and selected regulations. Some entries represent standard families or related methodologies rather than individual publications.<\/p>\n\n\n\n

\n\n\n\n

1. Software Process Improvement, Capability and Testing Maturity<\/h2>\n\n\n\n

Software engineering frameworks help organizations establish repeatable processes, improve development quality, measure capabilities, and continuously enhance software delivery.<\/p>\n\n\n\n

1. Automotive SPICE (ASPICE)<\/strong> \u2014 A process assessment model used in the automotive industry to evaluate and improve system and software development capabilities.<\/p>\n\n\n\n

2. SPICE (Software Process Improvement and Capability Determination)<\/strong> \u2014 A process assessment approach for evaluating organizational processes and identifying improvement opportunities.<\/p>\n\n\n\n

3. CMMI (Capability Maturity Model Integration)<\/strong> \u2014 A capability and maturity improvement model that helps organizations strengthen processes, performance, predictability, and quality.<\/p>\n\n\n\n

4. ISO\/IEC 330xx<\/strong> \u2014 A family of international standards defining principles, requirements, and methods for process assessment and capability determination.<\/p>\n\n\n\n

5. ISO\/IEC 15504<\/strong> \u2014 The legacy SPICE process assessment standards, largely superseded by the ISO\/IEC 330xx family.<\/p>\n\n\n\n

6. Automotive SPICE for Cybersecurity<\/strong> \u2014 An extension of Automotive SPICE incorporating cybersecurity engineering processes into automotive process capability assessments.<\/p>\n\n\n\n

7. MDevSPICE (Medical Device SPICE)<\/strong> \u2014 A process assessment model designed to evaluate medical device software development practices against relevant lifecycle and regulatory expectations.<\/p>\n\n\n\n

8. TMMi (Test Maturity Model Integration)<\/strong> \u2014 A five-level maturity model for systematically improving software testing processes and organizational testing capabilities.<\/p>\n\n\n\n

9. TPI NEXT (Test Process Improvement NEXT)<\/strong> \u2014 A structured approach for evaluating testing practices and prioritizing practical test process improvements.<\/p>\n\n\n\n

10. IT-CMF (IT Capability Maturity Framework)<\/strong> \u2014 A capability maturity framework for assessing and improving IT management, performance, business value, and digital transformation.<\/p>\n\n\n\n

11. ISO\/IEC\/IEEE 29119<\/strong> \u2014 An international software testing standards family covering testing concepts, processes, documentation, techniques, and related practices.<\/p>\n\n\n\n

12. ISO\/IEC 25010:2023<\/strong> \u2014 A software and ICT product quality model defining nine quality characteristics used to specify, evaluate, and improve product quality.<\/p>\n\n\n\n

13. ISO\/IEC\/IEEE 730<\/strong> \u2014 A software quality assurance standard providing guidance for planning, implementing, and managing software quality assurance processes.<\/p>\n\n\n\n

14. Six Sigma<\/strong> \u2014 A data-driven process improvement methodology focused on reducing variation, minimizing defects, and improving operational performance.<\/p>\n\n\n\n

15. CISQ (Consortium for Information & Software Quality)<\/strong> \u2014 An industry initiative establishing automated measures and standards for software structural quality, security, reliability, and maintainability.<\/p>\n\n\n\n

\n\n\n\n

2. Automotive, Functional Safety and Safety-Critical Engineering<\/h2>\n\n\n\n

Safety-critical engineering standards help organizations develop systems where software or hardware failures could create significant risks to human safety, equipment, or the environment.<\/p>\n\n\n\n

16. ISO 26262<\/strong> \u2014 The international functional safety standard for road vehicles, covering safety management, engineering, verification, and validation throughout the automotive lifecycle.<\/p>\n\n\n\n

17. ISO\/SAE 21434<\/strong> \u2014 An automotive cybersecurity engineering standard addressing cybersecurity risk management across vehicle development, production, operation, and post-development activities.<\/p>\n\n\n\n

18. IEC 61508<\/strong> \u2014 A foundational functional safety standard for electrical, electronic, and programmable electronic safety-related systems across industrial sectors.<\/p>\n\n\n\n

19. DO-178C<\/strong> \u2014 An aviation software development assurance standard used to support approval of safety-critical airborne software.<\/p>\n\n\n\n

20. DO-254<\/strong> \u2014 An aviation development assurance standard for airborne electronic hardware, including complex hardware used in safety-critical aircraft systems.<\/p>\n\n\n\n

21. IEC 62304<\/strong> \u2014 A medical device software lifecycle standard establishing requirements for software development, maintenance, and risk-related activities.<\/p>\n\n\n\n

22. ISO 13485<\/strong> \u2014 A quality management system standard designed for organizations developing, manufacturing, or supplying medical devices and related services.<\/p>\n\n\n\n

23. EN 50128<\/strong> \u2014 A legacy railway software safety standard covering software development for railway control and protection systems, superseded by EN 50716.<\/p>\n\n\n\n

24. ISO\/IEC\/IEEE 12207<\/strong> \u2014 An international standard defining software lifecycle processes from acquisition and development through operation, maintenance, and disposal.<\/p>\n\n\n\n

25. ISO\/IEC\/IEEE 15288<\/strong> \u2014 A systems engineering standard defining processes for managing complex systems throughout their complete lifecycle.<\/p>\n\n\n\n

26. ISO\/IEC 29110<\/strong> \u2014 A standards family providing simplified systems and software engineering lifecycle guidance tailored to very small entities.<\/p>\n\n\n\n

27. SPICE for Space<\/strong> \u2014 A space-sector process assessment approach applying SPICE principles to evaluate and improve space software engineering capabilities.<\/p>\n\n\n\n

\n\n\n\n

3. Cybersecurity, Information Security and AI Management<\/h2>\n\n\n\n

Cybersecurity frameworks provide structured approaches to protecting digital assets, managing security risks, securing infrastructure, and strengthening organizational resilience.<\/p>\n\n\n\n

28. ISO\/IEC 27001<\/strong> \u2014 An international standard specifying requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).<\/p>\n\n\n\n

29. NIST Cybersecurity Framework (CSF)<\/strong> \u2014 A cybersecurity risk management framework organized around Govern, Identify, Protect, Detect, Respond, and Recover functions.<\/p>\n\n\n\n

30. NIST SP 800-53<\/strong> \u2014 A comprehensive catalogue of security and privacy controls used to protect information systems and organizations.<\/p>\n\n\n\n

31. SOC 2 (System and Organization Controls 2)<\/strong> \u2014 An independent attestation reporting framework evaluating service organization controls against the AICPA Trust Services Criteria.<\/p>\n\n\n\n

32. PCI DSS (Payment Card Industry Data Security Standard)<\/strong> \u2014 A security standard defining requirements for protecting payment account data and securing cardholder data environments.<\/p>\n\n\n\n

33. IEC 62443<\/strong> \u2014 A series of industrial cybersecurity standards addressing security requirements for industrial automation and control systems.<\/p>\n\n\n\n

34. CMMC (Cybersecurity Maturity Model Certification)<\/strong> \u2014 A US Department of Defense program assessing contractor cybersecurity practices for protecting federal contract information and controlled unclassified information.<\/p>\n\n\n\n

35. ISO\/IEC 42001<\/strong> \u2014 The international management system standard for governing artificial intelligence activities, managing AI-related risks, and supporting responsible AI deployment.<\/p>\n\n\n\n

\n\n\n\n

4. IT Service Management, Enterprise Governance and Risk Management<\/h2>\n\n\n\n

IT governance and service management frameworks help organizations align technology services with business objectives while maintaining quality, accountability, and operational resilience.<\/p>\n\n\n\n

36. ITIL (Information Technology Infrastructure Library)<\/strong> \u2014 A widely adopted framework of service management principles and practices for delivering and improving technology-enabled services.<\/p>\n\n\n\n

37. COBIT (Control Objectives for Information and Related Technology)<\/strong> \u2014 An enterprise governance and management framework for aligning information and technology with business objectives.<\/p>\n\n\n\n

38. ISO\/IEC 20000-1<\/strong> \u2014 An international standard specifying requirements for establishing, operating, maintaining, and improving an IT service management system.<\/p>\n\n\n\n

39. FitSM<\/strong> \u2014 A lightweight IT service management standards family designed to help organizations implement practical and streamlined service management processes.<\/p>\n\n\n\n

40. VeriSM<\/strong> \u2014 A service management approach combining governance, emerging technologies, organizational capabilities, and management practices for digital services.<\/p>\n\n\n\n

41. ISO 22301<\/strong> \u2014 An international standard defining requirements for business continuity management systems and organizational preparedness for disruptive incidents.<\/p>\n\n\n\n

42. ISO 31000<\/strong> \u2014 An international risk management guideline providing principles, a framework, and processes for identifying and managing organizational risks.<\/p>\n\n\n\n

\n\n\n\n

5. Business Excellence, Organizational Maturity and Continuous Improvement<\/h2>\n\n\n\n

Business excellence frameworks help organizations improve performance, develop organizational capabilities, optimize processes, and establish cultures of continuous improvement.<\/p>\n\n\n\n

43. EFQM Model (European Foundation for Quality Management)<\/strong> \u2014 An organizational excellence framework for assessing strategic direction, execution, stakeholder value, and sustainable performance.<\/p>\n\n\n\n

44. Baldrige Excellence Framework<\/strong> \u2014 A performance excellence framework helping organizations evaluate leadership, strategy, customers, workforce, operations, and results.<\/p>\n\n\n\n

45. Lean Management<\/strong> \u2014 A management philosophy focused on maximizing customer value while minimizing waste, delays, and unnecessary activities.<\/p>\n\n\n\n

46. Kaizen<\/strong> \u2014 A continuous improvement philosophy emphasizing frequent, incremental changes driven by employee involvement and systematic problem-solving.<\/p>\n\n\n\n

47. BPMM (Business Process Maturity Model)<\/strong> \u2014 A maturity model for evaluating and improving the predictability, consistency, and effectiveness of organizational business processes.<\/p>\n\n\n\n

48. OPM3 (Organizational Project Management Maturity Model)<\/strong> \u2014 A PMI-developed maturity model for evaluating organizational project management capabilities and alignment with strategic goals.<\/p>\n\n\n\n

49. P3M3 (Portfolio, Programme and Project Management Maturity Model)<\/strong> \u2014 A maturity assessment model for evaluating portfolio, programme, and project management capabilities across organizations.<\/p>\n\n\n\n

50. People CMM (People Capability Maturity Model)<\/strong> \u2014 A maturity model for systematically improving workforce development, competency management, and people-related organizational practices.<\/p>\n\n\n\n

51. DMM (Data Management Maturity Model)<\/strong> \u2014 A capability maturity model for assessing and improving enterprise data governance, management, quality, and operational practices.<\/p>\n\n\n\n

\n\n\n\n

6. Quality, Environmental, Energy, Resilience and IT Governance Standards<\/h2>\n\n\n\n

Management system standards provide organizations with structured requirements and guidance for managing quality, environmental responsibilities, workplace safety, energy performance, and governance.<\/p>\n\n\n\n

52. ISO 9001:2026<\/strong> \u2014 An international quality management system standard helping organizations consistently meet customer requirements and continuously improve operational performance.<\/p>\n\n\n\n

53. ISO 14001<\/strong> \u2014 An environmental management system standard helping organizations manage environmental responsibilities, reduce impacts, and improve environmental performance.<\/p>\n\n\n\n

54. ISO 45001<\/strong> \u2014 An occupational health and safety management system standard focused on preventing work-related injuries, illnesses, and hazardous workplace conditions.<\/p>\n\n\n\n

55. ISO 50001<\/strong> \u2014 An energy management system standard helping organizations systematically improve energy efficiency, energy performance, and energy-related operational management.<\/p>\n\n\n\n

56. ISO 22316<\/strong> \u2014 An international guideline providing principles and attributes for strengthening organizational resilience and adaptability.<\/p>\n\n\n\n

57. ISO\/IEC 38500<\/strong> \u2014 An international governance standard providing principles for the effective, efficient, and acceptable use of information technology within organizations.<\/p>\n\n\n\n

58. ISO\/IEC 27701:2025<\/strong> \u2014 An international standard establishing requirements and guidance for implementing and improving a Privacy Information Management System.<\/p>\n\n\n\n

59. ISO\/IEC 38505 Series<\/strong> \u2014 A set of governance standards providing guidance on the organizational governance of data and its responsible use.<\/p>\n\n\n\n

\n\n\n\n

7. Secure Software Development, Application Security and Agile Frameworks<\/h2>\n\n\n\n

These frameworks focus on secure software engineering, application security maturity, vulnerability prevention, and adaptive software delivery practices.<\/p>\n\n\n\n

60. NIST SP 800-218 (Secure Software Development Framework)<\/strong> \u2014 A secure software development framework providing practices to reduce vulnerabilities and improve software supply-chain security.<\/p>\n\n\n\n

61. OWASP SAMM (Software Assurance Maturity Model)<\/strong> \u2014 An open-source model for assessing and improving software security practices across the development lifecycle.<\/p>\n\n\n\n

62. BSIMM (Building Security In Maturity Model)<\/strong> \u2014 An observational software security model that benchmarks real-world security practices across participating organizations.<\/p>\n\n\n\n

63. OWASP ASVS (Application Security Verification Standard)<\/strong> \u2014 A structured standard defining security verification requirements for assessing and testing web applications and services.<\/p>\n\n\n\n

64. OWASP MASVS (Mobile Application Security Verification Standard)<\/strong> \u2014 A mobile application security standard defining requirements for secure mobile application design, development, and verification.<\/p>\n\n\n\n

65. SAFe (Scaled Agile Framework)<\/strong> \u2014 An enterprise agile framework for coordinating agile teams, portfolios, business objectives, and large-scale software delivery.<\/p>\n\n\n\n

66. Scrum<\/strong> \u2014 A lightweight agile framework for delivering complex products through iterative development, clear accountabilities, and continuous inspection and adaptation.<\/p>\n\n\n\n

67. Kanban Method<\/strong> \u2014 A workflow management method focused on visualizing work, limiting work in progress, improving flow, and supporting evolutionary change.<\/p>\n\n\n\n

68. ISO\/IEC 38507<\/strong> \u2014 A governance guideline examining how artificial intelligence affects organizational leadership, accountability, decision-making, and oversight.<\/p>\n\n\n\n

69. ISO\/IEC 23894<\/strong> \u2014 An international guideline for identifying, assessing, treating, and monitoring risks associated with artificial intelligence systems.<\/p>\n\n\n\n

\n\n\n\n

8. Cloud Security, Healthcare Security, IT Assets and Project Management<\/h2>\n\n\n\n

These standards address cloud protection, healthcare information security, technology asset management, project quality, and structured project delivery.<\/p>\n\n\n\n

70. ISO\/IEC 27017<\/strong> \u2014 A cloud security guidance standard providing additional information security controls and implementation guidance for cloud service providers and customers.<\/p>\n\n\n\n

71. ISO\/IEC 27018<\/strong> \u2014 A cloud privacy standard addressing the protection of personally identifiable information processed in public cloud environments.<\/p>\n\n\n\n

72. ISO\/IEC 27799<\/strong> \u2014 A health informatics security standard providing guidance for managing information security in healthcare organizations.<\/p>\n\n\n\n

73. ISO\/IEC 19770 Series<\/strong> \u2014 A family of international standards for IT asset management, including software asset management, identification, and entitlement information.<\/p>\n\n\n\n

74. ISO 10006<\/strong> \u2014 A quality management guideline providing practices for managing quality throughout project planning, execution, and completion.<\/p>\n\n\n\n

75. ISO 21502<\/strong> \u2014 An international project management guideline defining concepts and practices for initiating, planning, managing, controlling, and closing projects.<\/p>\n\n\n\n

76. PRINCE2 (Projects IN Controlled Environments)<\/strong> \u2014 A structured project management method emphasizing business justification, defined roles, project stages, governance, and controlled delivery.<\/p>\n\n\n\n

\n\n\n\n

9. Requirements Engineering, Architecture and Advanced Software Quality<\/h2>\n\n\n\n

Engineering standards in this category support requirements traceability, architecture consistency, verification, technical documentation, and objective software quality measurements.<\/p>\n\n\n\n

77. ISO\/IEC\/IEEE 29148<\/strong> \u2014 An international requirements engineering standard covering stakeholder needs, system and software requirements, specifications, and traceability.<\/p>\n\n\n\n

78. ISO\/IEC\/IEEE 42010<\/strong> \u2014 A standard providing requirements and guidance for describing and communicating system, software, and enterprise architectures.<\/p>\n\n\n\n

79. ISO\/IEC\/IEEE 15289<\/strong> \u2014 A lifecycle documentation standard defining the purpose and content of information items produced during systems and software engineering.<\/p>\n\n\n\n

80. IEEE 1012-2024<\/strong> \u2014 A verification and validation standard defining practices for evaluating whether systems, software, and hardware satisfy requirements and intended uses.<\/p>\n\n\n\n

81. ISO\/IEC\/IEEE 15939<\/strong> \u2014 An international measurement process standard supporting the definition, collection, analysis, and interpretation of engineering performance metrics.<\/p>\n\n\n\n

82. ISO\/IEC 5055<\/strong> \u2014 A source-code quality measurement standard defining automated measures for evaluating structural software quality and identifying critical weaknesses.<\/p>\n\n\n\n

83. ISO\/IEC 25023<\/strong> \u2014 A product quality measurement standard defining measures used to evaluate software and system quality characteristics.<\/p>\n\n\n\n

84. ISO\/IEC 25040:2024<\/strong> \u2014 A quality evaluation framework providing guidance and requirements for evaluating ICT products, software, data, and IT services.<\/p>\n\n\n\n

85. ISO\/IEC\/IEEE 24748-1<\/strong> \u2014 A lifecycle management guideline supporting the effective application and integration of systems and software lifecycle processes.<\/p>\n\n\n\n

\n\n\n\n

10. Advanced Automotive, Railway, Aerospace, Medical Device and Industrial Standards<\/h2>\n\n\n\n

These additional industry-specific standards strengthen engineering quality, functional safety, cybersecurity, supplier assurance, system validation, and regulatory compliance.<\/p>\n\n\n\n

86. IATF 16949<\/strong> \u2014 An automotive quality management system standard establishing sector-specific requirements for quality, defect prevention, and continual improvement throughout automotive supply chains.<\/p>\n\n\n\n

87. VDA 6.3<\/strong> \u2014 An automotive process audit methodology used to evaluate product development, production processes, supplier capabilities, and process-related risks.<\/p>\n\n\n\n

88. Automotive Core Tools (APQP, Control Plan, PPAP, FMEA, MSA, SPC)<\/strong> \u2014 A collection of automotive quality planning, risk prevention, measurement, process control, and product approval methods.<\/p>\n\n\n\n

89. ISO 21448 (SOTIF)<\/strong> \u2014 An automotive safety standard addressing hazards caused by functional insufficiencies and reasonably foreseeable misuse without requiring component malfunction.<\/p>\n\n\n\n

90. ISO 24089<\/strong> \u2014 An automotive software update engineering standard defining processes for planning, developing, verifying, validating, and managing vehicle software updates.<\/p>\n\n\n\n

91. UNECE UN Regulation No. 155 (UN R155)<\/strong> \u2014 A vehicle cybersecurity regulation establishing requirements for cybersecurity management systems and vehicle cybersecurity approval.<\/p>\n\n\n\n

92. UNECE UN Regulation No. 156 (UN R156)<\/strong> \u2014 A vehicle software update regulation establishing requirements for software update management systems and software update approval.<\/p>\n\n\n\n

93. ISO\/PAS 8800<\/strong> \u2014 An automotive engineering specification addressing safety-related risks and assurance practices associated with artificial intelligence in road vehicles.<\/p>\n\n\n\n

94. ISO\/TS 5083<\/strong> \u2014 A technical specification addressing safety engineering, design, verification, and validation for automated driving systems.<\/p>\n\n\n\n

95. ISO 34502<\/strong> \u2014 An automotive standard providing a scenario-based safety evaluation framework for automated driving systems.<\/p>\n\n\n\n

96. ISO 34503<\/strong> \u2014 An automotive standard defining how to specify an automated driving system’s operational design domain and operating conditions.<\/p>\n\n\n\n

97. EN 50716<\/strong> \u2014 A railway software development standard establishing process and technical requirements for railway software, replacing EN 50128 and EN 50657.<\/p>\n\n\n\n

98. EN 50126<\/strong> \u2014 A railway standard family addressing reliability, availability, maintainability, and safety throughout railway system lifecycles.<\/p>\n\n\n\n

99. EN 50129<\/strong> \u2014 A railway safety standard establishing requirements for safety-related electronic systems used in signalling applications.<\/p>\n\n\n\n

100. ISO 14971<\/strong> \u2014 A medical device risk management standard defining processes for identifying hazards, evaluating risks, implementing controls, and monitoring effectiveness.<\/p>\n\n\n\n

101. IEC 62366-1<\/strong> \u2014 A medical device usability engineering standard focusing on reducing risks associated with user interaction and use-related errors.<\/p>\n\n\n\n

102. IEC 81001-5-1<\/strong> \u2014 A health software security standard defining secure product lifecycle activities for health software and health IT systems.<\/p>\n\n\n\n

103. IEC 82304-1<\/strong> \u2014 A health software product standard defining requirements for product safety, security, and lifecycle management.<\/p>\n\n\n\n

104. IEC 61511<\/strong> \u2014 A functional safety standard covering safety-instrumented systems used in the process industry sector.<\/p>\n\n\n\n

105. IEC 62061<\/strong> \u2014 A machinery functional safety standard addressing the design, integration, and validation of safety-related control systems.<\/p>\n\n\n\n

106. SAE ARP4754B<\/strong> \u2014 An aerospace guideline defining development assurance processes for aircraft and systems, including requirements management and verification.<\/p>\n\n\n\n

107. SAE ARP4761A<\/strong> \u2014 An aerospace guideline providing safety assessment methods for identifying hazards and evaluating aircraft system safety risks.<\/p>\n\n\n\n

108. RTCA DO-326A \/ EUROCAE ED-202A<\/strong> \u2014 Airworthiness security guidance addressing cybersecurity risk management and assurance for aircraft systems.<\/p>\n\n\n\n

109. ECSS-E-ST-40C Rev.1<\/strong> \u2014 A European space engineering standard defining software development requirements for space systems and related ground infrastructure.<\/p>\n\n\n\n

110. ECSS-Q-ST-80C Rev.2<\/strong> \u2014 A European space product assurance standard defining software product assurance and quality-related activities for space projects.<\/p>\n\n\n\n

111. AS9100 \/ IAQG 9100<\/strong> \u2014 An aerospace quality management system standard supplementing ISO 9001 with aerospace and defense industry requirements.<\/p>\n\n\n\n

112. AIAG CQI-34 (Software Assurance Approval Process \/ SwAAP)<\/strong> \u2014 An automotive industry manual establishing a structured approach to software quality assurance, supplier collaboration, and software approval.<\/p>\n\n\n\n

\n\n\n\n

11. Advanced Cybersecurity, Privacy, Cloud and Software Supply-Chain Security<\/h2>\n\n\n\n

This category brings together technical security controls, cybersecurity risk management guidance, secure configuration standards, and software supply-chain assurance frameworks.<\/p>\n\n\n\n

113. ISO\/IEC 27002<\/strong> \u2014 An international information security standard providing implementation guidance for organizational, people, physical, and technological security controls.<\/p>\n\n\n\n

114. ISO\/IEC 27005<\/strong> \u2014 An information security risk management guideline supporting risk identification, analysis, evaluation, treatment, and monitoring.<\/p>\n\n\n\n

115. ISO\/IEC 27035 Series<\/strong> \u2014 A family of information security incident management standards addressing incident preparation, detection, assessment, response, and organizational learning.<\/p>\n\n\n\n

116. ISO\/IEC 27036 Series<\/strong> \u2014 A set of standards providing guidance for managing information security risks across supplier and supply-chain relationships.<\/p>\n\n\n\n

117. ISO\/IEC 27031:2025<\/strong> \u2014 A standard providing guidance for preparing information and communication technology to support business continuity.<\/p>\n\n\n\n

118. ISO\/IEC 27034 Series<\/strong> \u2014 An application security standards family supporting the integration of security into application development and management processes.<\/p>\n\n\n\n

119. ISO\/IEC 29147<\/strong> \u2014 A vulnerability disclosure standard defining guidelines for receiving, coordinating, and communicating vulnerability information.<\/p>\n\n\n\n

120. ISO\/IEC 30111<\/strong> \u2014 A vulnerability handling standard providing guidelines for analyzing, remediating, and coordinating reported product vulnerabilities.<\/p>\n\n\n\n

121. ISO\/IEC 15408 (Common Criteria)<\/strong> \u2014 An international framework for specifying and independently evaluating the security properties of IT products.<\/p>\n\n\n\n

122. ISO\/IEC 29100<\/strong> \u2014 A privacy framework defining privacy principles, terminology, and a structured approach to protecting personally identifiable information.<\/p>\n\n\n\n

123. ISO\/IEC 29134<\/strong> \u2014 A privacy impact assessment guideline for identifying and managing privacy risks associated with information systems and processing activities.<\/p>\n\n\n\n

124. NIST SP 800-37 (Risk Management Framework)<\/strong> \u2014 A structured risk management process for categorizing systems, selecting controls, assessing security, authorizing systems, and monitoring risks.<\/p>\n\n\n\n

125. NIST SP 800-61 Rev.3<\/strong> \u2014 Cybersecurity incident response guidance integrated with the NIST Cybersecurity Framework and organizational cybersecurity risk management.<\/p>\n\n\n\n

126. NIST SP 800-207 (Zero Trust Architecture)<\/strong> \u2014 A cybersecurity architecture guideline emphasizing continuous verification, least-privilege access, and reduced reliance on network location.<\/p>\n\n\n\n

127. NIST SP 800-161 Rev.1<\/strong> \u2014 Cybersecurity supply-chain risk management guidance for identifying, assessing, and reducing risks associated with suppliers, products, and services.<\/p>\n\n\n\n

128. NIST SP 800-171 Rev.3<\/strong> \u2014 Security requirements for protecting controlled unclassified information in nonfederal systems and organizations.<\/p>\n\n\n\n

129. CIS Critical Security Controls v8.1<\/strong> \u2014 A prioritized set of actionable cybersecurity safeguards designed to reduce common attack risks.<\/p>\n\n\n\n

130. CIS Benchmarks<\/strong> \u2014 Community-developed secure configuration guidelines for operating systems, cloud services, applications, databases, and infrastructure technologies.<\/p>\n\n\n\n

131. CSA Cloud Controls Matrix (CCM)<\/strong> \u2014 A cloud security control framework supporting cloud risk management, compliance assessments, and shared-responsibility evaluation.<\/p>\n\n\n\n

132. NIST Privacy Framework<\/strong> \u2014 A voluntary privacy risk management framework helping organizations identify and manage privacy risks associated with data processing.<\/p>\n\n\n\n

133. MITRE ATT&CK<\/strong> \u2014 A knowledge base of real-world adversary tactics and techniques used for threat modeling, detection engineering, and security assessment.<\/p>\n\n\n\n

134. OWASP Top 10:2025<\/strong> \u2014 A security awareness reference identifying major categories of risks affecting modern web applications.<\/p>\n\n\n\n

135. OWASP API Security Top 10<\/strong> \u2014 A security reference identifying major risks affecting application programming interfaces, including authorization and authentication weaknesses.<\/p>\n\n\n\n

136. SLSA (Supply-chain Levels for Software Artifacts)<\/strong> \u2014 A framework defining progressive levels of assurance for software build integrity, provenance, and supply-chain protection.<\/p>\n\n\n\n

137. OpenSSF OSPS Baseline<\/strong> \u2014 A set of open-source project security requirements organized by maturity level to support secure development and maintenance practices.<\/p>\n\n\n\n

138. TISAX \/ VDA ISA<\/strong> \u2014 An automotive information security assessment and assurance scheme used by industry partners to evaluate and exchange supplier security assessment results.<\/p>\n\n\n\n

\n\n\n\n

12. Artificial Intelligence Governance, AI Risk Management and Data Maturity<\/h2>\n\n\n\n

AI governance and data management frameworks help organizations develop trustworthy AI systems, manage AI risks, improve data quality, and establish responsible governance practices.<\/p>\n\n\n\n

139. NIST AI Risk Management Framework (AI RMF)<\/strong> \u2014 A voluntary framework for identifying, measuring, managing, and governing risks associated with artificial intelligence systems.<\/p>\n\n\n\n

140. NIST AI 600-1 (Generative AI Profile)<\/strong> \u2014 A companion profile to the NIST AI RMF addressing risks and risk management considerations specific to generative AI.<\/p>\n\n\n\n

141. ISO\/IEC 42005<\/strong> \u2014 An international guideline for conducting AI system impact assessments and documenting potential effects on individuals, groups, and society.<\/p>\n\n\n\n

142. ISO\/IEC 42006<\/strong> \u2014 A standard establishing additional requirements for bodies that audit and certify artificial intelligence management systems.<\/p>\n\n\n\n

143. ISO\/IEC 5338<\/strong> \u2014 An AI system lifecycle standard defining processes for developing, operating, maintaining, and managing AI-enabled systems.<\/p>\n\n\n\n

144. ISO\/IEC 22989<\/strong> \u2014 An international standard defining foundational artificial intelligence terminology, concepts, and classifications.<\/p>\n\n\n\n

145. ISO\/IEC 23053<\/strong> \u2014 A framework describing AI systems that use machine learning, including system components, interactions, and lifecycle considerations.<\/p>\n\n\n\n

146. ISO\/IEC 5259 Series<\/strong> \u2014 A standards family addressing data quality management and measurement for analytics and machine learning applications.<\/p>\n\n\n\n

147. ISO\/IEC 25059<\/strong> \u2014 An AI system quality model defining characteristics used to specify and evaluate artificial intelligence system quality.<\/p>\n\n\n\n

148. ISO\/IEC 25012<\/strong> \u2014 A data quality model defining characteristics used to evaluate the quality of data within information systems.<\/p>\n\n\n\n

149. DAMA-DMBOK (Data Management Body of Knowledge)<\/strong> \u2014 A comprehensive reference framework covering data governance, architecture, quality, security, integration, and other data management disciplines.<\/p>\n\n\n\n

150. EDM Council DCAM (Data Management Capability Assessment Model)<\/strong> \u2014 A capability assessment framework for evaluating enterprise data management maturity, governance, architecture, controls, and operational capabilities.<\/p>\n\n\n\n

151. EDM Council CDMC (Cloud Data Management Capabilities)<\/strong> \u2014 A framework defining essential controls and capabilities for managing and protecting data in cloud environments.<\/p>\n\n\n\n

152. OWASP Top 10 for LLM \/ Generative AI Applications<\/strong> \u2014 A security risk reference highlighting common vulnerabilities and weaknesses in applications powered by large language models.<\/p>\n\n\n\n

\n\n\n\n

13. Enterprise Architecture, Project Management, DevOps and Cloud Financial Management<\/h2>\n\n\n\n

Enterprise technology and project management frameworks help organizations align architecture, technology investment, project delivery, operational reliability, and business outcomes.<\/p>\n\n\n\n

153. TOGAF Standard, 10th Edition<\/strong> \u2014 An enterprise architecture framework providing methods, structures, and governance practices for designing and evolving enterprise architectures.<\/p>\n\n\n\n

154. ArchiMate<\/strong> \u2014 An enterprise architecture modeling language used to represent business processes, applications, technologies, relationships, and architectural changes.<\/p>\n\n\n\n

155. IT4IT Reference Architecture<\/strong> \u2014 A reference architecture for managing IT value streams, digital products, service delivery, and technology operating models.<\/p>\n\n\n\n

156. PMBOK Guide, Eighth Edition<\/strong> \u2014 PMI’s project management body of knowledge providing principles, performance domains, and practices for delivering successful projects.<\/p>\n\n\n\n

157. ISO 21503<\/strong> \u2014 An international guideline providing concepts and practices for effective programme management.<\/p>\n\n\n\n

158. ISO 21504<\/strong> \u2014 An international guideline providing principles and practices for managing portfolios of projects and programmes.<\/p>\n\n\n\n

159. FinOps Framework<\/strong> \u2014 A technology financial management framework helping finance, engineering, and business teams optimize cloud and other technology spending.<\/p>\n\n\n\n

160. Site Reliability Engineering (SRE)<\/strong> \u2014 An engineering discipline applying software practices, service-level objectives, automation, and operational measurement to improve system reliability.<\/p>\n\n\n\n

161. DORA Software Delivery Performance Metrics<\/strong> \u2014 Research-based software delivery performance measures used to evaluate delivery throughput, stability, and engineering improvement.<\/p>\n\n\n\n

\n\n\n\n

14. Advanced Quality Auditing, Compliance, Sustainability and Asset Management<\/h2>\n\n\n\n

These standards provide guidance for assessing management systems, strengthening compliance, improving organizational sustainability, and managing critical assets.<\/p>\n\n\n\n

162. ISO 19011:2026<\/strong> \u2014 An international guideline providing principles and practices for management system auditing, audit programme management, and auditor competence.<\/p>\n\n\n\n

163. ISO 9004<\/strong> \u2014 A quality management guideline focused on sustained organizational success, performance improvement, and long-term value creation.<\/p>\n\n\n\n

164. IEC 31010<\/strong> \u2014 An international standard providing techniques for assessing and analyzing risks across different organizational activities and industries.<\/p>\n\n\n\n

165. ISO 37301<\/strong> \u2014 A compliance management system standard establishing requirements for developing, implementing, maintaining, and improving organizational compliance programmes.<\/p>\n\n\n\n

166. ISO 37001<\/strong> \u2014 An anti-bribery management system standard providing requirements for preventing, detecting, and responding to bribery risks.<\/p>\n\n\n\n

167. ISO\/TS 22317<\/strong> \u2014 A business continuity guideline providing a structured approach to conducting business impact analysis.<\/p>\n\n\n\n

168. ISO 22361<\/strong> \u2014 A crisis management guideline helping organizations prepare for, respond to, and learn from major crises.<\/p>\n\n\n\n

169. ISO 55001<\/strong> \u2014 An asset management system standard defining requirements for managing asset value, performance, risks, and lifecycle activities.<\/p>\n\n\n\n

170. ISO 14064-1<\/strong> \u2014 An international standard providing requirements and guidance for quantifying and reporting organizational greenhouse gas emissions and removals.<\/p>\n\n\n\n

\n\n\n\n

How to Use These 170 Standards and Frameworks<\/h2>\n\n\n\n

Organizations should not attempt to implement every framework in this catalogue.<\/p>\n\n\n\n

Instead, they should identify the standards and methodologies most relevant to their industry, regulatory obligations, business objectives, product risks, and organizational maturity.<\/p>\n\n\n\n

For example, an automotive software organization might prioritize ASPICE, ISO 26262, ISO\/SAE 21434, ISO 21448, ISO 24089, and IATF 16949.<\/p>\n\n\n\n

A software product company might focus on CMMI, ISO\/IEC\/IEEE 12207, ISO\/IEC 25010, ISO\/IEC 27001, NIST SSDF, OWASP SAMM, and relevant DevOps practices.<\/p>\n\n\n\n

A healthcare technology provider might prioritize IEC 62304, ISO 13485, ISO 14971, IEC 62366-1, and applicable information security and privacy standards.<\/p>\n\n\n\n

An AI-focused organization might prioritize ISO\/IEC 42001, ISO\/IEC 23894, NIST AI RMF, ISO\/IEC 42005, ISO\/IEC 5338, and relevant data governance frameworks.<\/p>\n\n\n\n

The objective is not simply to adopt more standards, but to build processes that are practical, measurable, efficient, secure, and continuously improving.<\/p>\n\n\n\n

Understanding Standards, Frameworks, and Maturity Models<\/h2>\n\n\n\n

Although these terms are frequently used interchangeably, they represent different concepts.<\/p>\n\n\n\n

Standards<\/strong> establish agreed requirements, specifications, or guidance for particular activities, systems, or management practices.<\/p>\n\n\n\n

Frameworks<\/strong> provide organized structures, principles, practices, or reference models for addressing particular challenges.<\/p>\n\n\n\n

Maturity models<\/strong> assess how systematically and effectively an organization performs activities and improves organizational capabilities.<\/p>\n\n\n\n

Methodologies<\/strong> define approaches, principles, techniques, and practices for performing work or improving outcomes.<\/p>\n\n\n\n

Regulations<\/strong> establish legal or regulatory obligations within specified jurisdictions and scopes.<\/p>\n\n\n\n

Some standards support formal certification or conformity assessment, while others provide voluntary guidance. A maturity assessment is not automatically equivalent to certification or regulatory compliance.<\/p>\n\n\n\n

Official References and Further Reading<\/h2>\n\n\n\n

Readers should consult the official publishers for complete requirements, edition status, licensing, and implementation details.<\/p>\n\n\n\n