{"id":79613,"date":"2026-10-28T08:23:49","date_gmt":"2026-10-28T08:23:49","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=79613"},"modified":"2026-10-28T08:23:50","modified_gmt":"2026-10-28T08:23:50","slug":"list-of-industry-standards-frameworks-maturity-models-and-methodologies","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/list-of-industry-standards-frameworks-maturity-models-and-methodologies\/","title":{"rendered":"List of Industry Standards, Frameworks, Maturity Models and Methodologies"},"content":{"rendered":"\n
No.<\/strong><\/td>Category<\/strong><\/td>Standard \/ Framework<\/strong><\/td>One-Line Introduction<\/strong><\/td><\/tr>
1<\/strong><\/td>Software Process Improvement and Testing Maturity<\/td>Automotive SPICE (ASPICE)<\/td>An automotive process assessment model used to evaluate and improve system and software development capability.<\/td><\/tr>
2<\/strong><\/td>Software Process Improvement and Testing Maturity<\/td>SPICE (Software Process Improvement and Capability Determination)<\/td>A process assessment approach for evaluating organizational processes and guiding improvements.<\/td><\/tr>
3<\/strong><\/td>Software Process Improvement and Testing Maturity<\/td>CMMI (Capability Maturity Model Integration)<\/td>A capability and maturity improvement model for strengthening processes, predictability, and performance.<\/td><\/tr>
4<\/strong><\/td>Software Process Improvement and Testing Maturity<\/td>ISO\/IEC 330xx<\/td>A family of standards defining principles and methods for process assessment and capability determination.<\/td><\/tr>
5<\/strong><\/td>Software Process Improvement and Testing Maturity<\/td>ISO\/IEC 15504<\/td>A legacy family of SPICE process assessment standards largely superseded by ISO\/IEC 330xx.<\/td><\/tr>
6<\/strong><\/td>Software Process Improvement and Testing Maturity<\/td>Automotive SPICE for Cybersecurity<\/td>An extension of Automotive SPICE that assesses cybersecurity engineering process capability.<\/td><\/tr>
7<\/strong><\/td>Software Process Improvement and Testing Maturity<\/td>MDevSPICE (Medical Device SPICE)<\/td>A process assessment model for medical device software development and lifecycle practices.<\/td><\/tr>
8<\/strong><\/td>Software Process Improvement and Testing Maturity<\/td>TMMi (Test Maturity Model Integration)<\/td>A five-level maturity model for systematic improvement of software testing processes.<\/td><\/tr>
9<\/strong><\/td>Software Process Improvement and Testing Maturity<\/td>TPI NEXT (Test Process Improvement NEXT)<\/td>An approach for assessing test practices and prioritizing practical testing improvements.<\/td><\/tr>
10<\/strong><\/td>Software Process Improvement and Testing Maturity<\/td>IT-CMF (IT Capability Maturity Framework)<\/td>A capability maturity framework for improving IT management, business value, and digital transformation.<\/td><\/tr>
11<\/strong><\/td>Software Process Improvement and Testing Maturity<\/td>ISO\/IEC\/IEEE 29119<\/td>A software testing standards family covering processes, documentation, techniques, and concepts.<\/td><\/tr>
12<\/strong><\/td>Software Process Improvement and Testing Maturity<\/td>ISO\/IEC 25010:2023<\/td>A product quality model defining nine characteristics for specifying and evaluating software and ICT quality.<\/td><\/tr>
13<\/strong><\/td>Software Process Improvement and Testing Maturity<\/td>ISO\/IEC\/IEEE 730<\/td>A standard providing guidance for planning and implementing software quality assurance.<\/td><\/tr>
14<\/strong><\/td>Software Process Improvement and Testing Maturity<\/td>Six Sigma<\/td>A data-driven process improvement method for reducing variation, defects, and inefficiency.<\/td><\/tr>
15<\/strong><\/td>Software Process Improvement and Testing Maturity<\/td>CISQ (Consortium for Information & Software Quality)<\/td>An industry initiative supporting automated measures and standards for structural software quality.<\/td><\/tr>
16<\/strong><\/td>Automotive and Safety-Critical Engineering<\/td>ISO 26262<\/td>A functional safety standard for road vehicles covering automotive safety engineering and assurance.<\/td><\/tr>
17<\/strong><\/td>Automotive and Safety-Critical Engineering<\/td>ISO\/SAE 21434<\/td>An automotive cybersecurity engineering standard covering cybersecurity risk throughout the vehicle lifecycle.<\/td><\/tr>
18<\/strong><\/td>Automotive and Safety-Critical Engineering<\/td>IEC 61508<\/td>A foundational functional safety standard for electrical, electronic, and programmable electronic systems.<\/td><\/tr>
19<\/strong><\/td>Automotive and Safety-Critical Engineering<\/td>DO-178C<\/td>An aviation development assurance standard for safety-critical airborne software.<\/td><\/tr>
20<\/strong><\/td>Automotive and Safety-Critical Engineering<\/td>DO-254<\/td>An aviation development assurance standard for airborne electronic hardware.<\/td><\/tr>
21<\/strong><\/td>Automotive and Safety-Critical Engineering<\/td>IEC 62304<\/td>A medical device software lifecycle standard for development, maintenance, and risk-related activities.<\/td><\/tr>
22<\/strong><\/td>Automotive and Safety-Critical Engineering<\/td>ISO 13485<\/td>A quality management system standard for medical device organizations and related services.<\/td><\/tr>
23<\/strong><\/td>Automotive and Safety-Critical Engineering<\/td>EN 50128<\/td>A legacy railway software safety standard superseded by EN 50716.<\/td><\/tr>
24<\/strong><\/td>Automotive and Safety-Critical Engineering<\/td>ISO\/IEC\/IEEE 12207<\/td>A standard defining software lifecycle processes from acquisition through retirement.<\/td><\/tr>
25<\/strong><\/td>Automotive and Safety-Critical Engineering<\/td>ISO\/IEC\/IEEE 15288<\/td>A systems engineering standard defining processes across the full system lifecycle.<\/td><\/tr>
26<\/strong><\/td>Automotive and Safety-Critical Engineering<\/td>ISO\/IEC 29110<\/td>A standards family offering tailored systems and software lifecycle guidance for very small entities.<\/td><\/tr>
27<\/strong><\/td>Automotive and Safety-Critical Engineering<\/td>SPICE for Space<\/td>A space-sector process assessment approach applying SPICE principles to space software engineering.<\/td><\/tr>
28<\/strong><\/td>Cybersecurity, Information Security and AI Management<\/td>ISO\/IEC 27001<\/td>A standard specifying requirements for an information security management system (ISMS).<\/td><\/tr>
29<\/strong><\/td>Cybersecurity, Information Security and AI Management<\/td>NIST Cybersecurity Framework (CSF)<\/td>A cybersecurity risk framework organized around Govern, Identify, Protect, Detect, Respond, and Recover.<\/td><\/tr>
30<\/strong><\/td>Cybersecurity, Information Security and AI Management<\/td>NIST SP 800-53<\/td>A catalogue of security and privacy controls for information systems and organizations.<\/td><\/tr>
31<\/strong><\/td>Cybersecurity, Information Security and AI Management<\/td>SOC 2 (System and Organization Controls 2)<\/td>An attestation reporting framework evaluating service organization controls against Trust Services Criteria.<\/td><\/tr>
32<\/strong><\/td>Cybersecurity, Information Security and AI Management<\/td>PCI DSS (Payment Card Industry Data Security Standard)<\/td>A security standard protecting payment account data and cardholder data environments.<\/td><\/tr>
33<\/strong><\/td>Cybersecurity, Information Security and AI Management<\/td>IEC 62443<\/td>A standards series for cybersecurity in industrial automation and control systems.<\/td><\/tr>
34<\/strong><\/td>Cybersecurity, Information Security and AI Management<\/td>CMMC (Cybersecurity Maturity Model Certification)<\/td>A US defense-sector assessment program for safeguarding sensitive contract information.<\/td><\/tr>
35<\/strong><\/td>Cybersecurity, Information Security and AI Management<\/td>ISO\/IEC 42001<\/td>An AI management system standard for governing artificial intelligence and managing AI-related risks.<\/td><\/tr>
36<\/strong><\/td>IT Service Management and Governance<\/td>ITIL (Information Technology Infrastructure Library)<\/td>A service management framework for delivering and improving technology-enabled services.<\/td><\/tr>
37<\/strong><\/td>IT Service Management and Governance<\/td>COBIT (Control Objectives for Information and Related Technology)<\/td>An enterprise governance and management framework aligning information and technology with business objectives.<\/td><\/tr>
38<\/strong><\/td>IT Service Management and Governance<\/td>ISO\/IEC 20000-1<\/td>A standard defining requirements for an IT service management system.<\/td><\/tr>
39<\/strong><\/td>IT Service Management and Governance<\/td>FitSM<\/td>A lightweight IT service management standards family for practical service management processes.<\/td><\/tr>
40<\/strong><\/td>IT Service Management and Governance<\/td>VeriSM<\/td>A service management approach combining governance, capabilities, and digital service delivery practices.<\/td><\/tr>
41<\/strong><\/td>IT Service Management and Governance<\/td>ISO 22301<\/td>A business continuity management system standard for preparing for and responding to disruptions.<\/td><\/tr>
42<\/strong><\/td>IT Service Management and Governance<\/td>ISO 31000<\/td>A guideline providing principles and processes for managing organizational risk.<\/td><\/tr>
43<\/strong><\/td>Business Excellence and Organizational Maturity<\/td>EFQM Model (European Foundation for Quality Management)<\/td>An organizational excellence framework assessing direction, execution, stakeholder value, and results.<\/td><\/tr>
44<\/strong><\/td>Business Excellence and Organizational Maturity<\/td>Baldrige Excellence Framework<\/td>A performance excellence framework assessing leadership, strategy, customers, workforce, operations, and results.<\/td><\/tr>
45<\/strong><\/td>Business Excellence and Organizational Maturity<\/td>Lean Management<\/td>A management philosophy that maximizes customer value while reducing waste and delays.<\/td><\/tr>
46<\/strong><\/td>Business Excellence and Organizational Maturity<\/td>Kaizen<\/td>A continuous improvement philosophy centered on frequent, incremental changes and employee participation.<\/td><\/tr>
47<\/strong><\/td>Business Excellence and Organizational Maturity<\/td>BPMM (Business Process Maturity Model)<\/td>A maturity model for improving the consistency, predictability, and effectiveness of business processes.<\/td><\/tr>
48<\/strong><\/td>Business Excellence and Organizational Maturity<\/td>OPM3 (Organizational Project Management Maturity Model)<\/td>A PMI maturity model assessing project management capability and strategic alignment.<\/td><\/tr>
49<\/strong><\/td>Business Excellence and Organizational Maturity<\/td>P3M3 (Portfolio, Programme and Project Management Maturity Model)<\/td>A maturity assessment model for portfolio, programme, and project management capabilities.<\/td><\/tr>
50<\/strong><\/td>Business Excellence and Organizational Maturity<\/td>People CMM (People Capability Maturity Model)<\/td>A maturity model for improving workforce competencies, development, and people management.<\/td><\/tr>
51<\/strong><\/td>Business Excellence and Organizational Maturity<\/td>DMM (Data Management Maturity Model)<\/td>A maturity model for evaluating and improving enterprise data management capabilities.<\/td><\/tr>
52<\/strong><\/td>Quality, Environment, Energy and Governance<\/td>ISO 9001:2026<\/td>A quality management system standard for consistent customer outcomes and continual improvement.<\/td><\/tr>
53<\/strong><\/td>Quality, Environment, Energy and Governance<\/td>ISO 14001<\/td>An environmental management system standard for managing impacts and improving environmental performance.<\/td><\/tr>
54<\/strong><\/td>Quality, Environment, Energy and Governance<\/td>ISO 45001<\/td>An occupational health and safety management system standard for preventing work-related injury and illness.<\/td><\/tr>
55<\/strong><\/td>Quality, Environment, Energy and Governance<\/td>ISO 50001<\/td>An energy management system standard for systematically improving energy performance.<\/td><\/tr>
56<\/strong><\/td>Quality, Environment, Energy and Governance<\/td>ISO 22316<\/td>A guideline identifying principles and attributes of organizational resilience.<\/td><\/tr>
57<\/strong><\/td>Quality, Environment, Energy and Governance<\/td>ISO\/IEC 38500<\/td>An international standard providing principles for organizational governance of information technology.<\/td><\/tr>
58<\/strong><\/td>Quality, Environment, Energy and Governance<\/td>ISO\/IEC 27701:2025<\/td>A privacy information management system standard for managing privacy-related risks and responsibilities.<\/td><\/tr>
59<\/strong><\/td>Quality, Environment, Energy and Governance<\/td>ISO\/IEC 38505 Series<\/td>A governance standards series addressing organizational governance and responsible use of data.<\/td><\/tr>
60<\/strong><\/td>Secure Development and Agile Methods<\/td>NIST SP 800-218 (Secure Software Development Framework)<\/td>A set of secure software development practices designed to reduce vulnerabilities and supply-chain risks.<\/td><\/tr>
61<\/strong><\/td>Secure Development and Agile Methods<\/td>OWASP SAMM (Software Assurance Maturity Model)<\/td>An open-source model for assessing and improving software security practices across the lifecycle.<\/td><\/tr>
62<\/strong><\/td>Secure Development and Agile Methods<\/td>BSIMM (Building Security In Maturity Model)<\/td>An observational model benchmarking software security practices at participating organizations.<\/td><\/tr>
63<\/strong><\/td>Secure Development and Agile Methods<\/td>OWASP ASVS (Application Security Verification Standard)<\/td>A standard defining security verification requirements for web applications and services.<\/td><\/tr>
64<\/strong><\/td>Secure Development and Agile Methods<\/td>OWASP MASVS (Mobile Application Security Verification Standard)<\/td>A mobile application security standard for secure design, development, and verification.<\/td><\/tr>
65<\/strong><\/td>Secure Development and Agile Methods<\/td>SAFe (Scaled Agile Framework)<\/td>An enterprise agile framework for coordinating teams, portfolios, and large-scale delivery.<\/td><\/tr>
66<\/strong><\/td>Secure Development and Agile Methods<\/td>Scrum<\/td>A lightweight agile framework for iterative delivery through defined accountabilities and events.<\/td><\/tr>
67<\/strong><\/td>Secure Development and Agile Methods<\/td>Kanban Method<\/td>A workflow management method for visualizing work, limiting work in progress, and improving flow.<\/td><\/tr>
68<\/strong><\/td>Secure Development and Agile Methods<\/td>ISO\/IEC 38507<\/td>Guidance on how artificial intelligence affects organizational governance and accountability.<\/td><\/tr>
69<\/strong><\/td>Secure Development and Agile Methods<\/td>ISO\/IEC 23894<\/td>Guidance for identifying, assessing, treating, and monitoring AI-related risks.<\/td><\/tr>
70<\/strong><\/td>Cloud Security, IT Assets and Project Management<\/td>ISO\/IEC 27017<\/td>Cloud security guidance offering additional controls for cloud providers and customers.<\/td><\/tr>
71<\/strong><\/td>Cloud Security, IT Assets and Project Management<\/td>ISO\/IEC 27018<\/td>Privacy guidance for protecting personally identifiable information in public cloud processing.<\/td><\/tr>
72<\/strong><\/td>Cloud Security, IT Assets and Project Management<\/td>ISO\/IEC 27799<\/td>Information security guidance tailored to healthcare organizations and health informatics.<\/td><\/tr>
73<\/strong><\/td>Cloud Security, IT Assets and Project Management<\/td>ISO\/IEC 19770 Series<\/td>A family of IT asset management standards covering management systems and asset information.<\/td><\/tr>
74<\/strong><\/td>Cloud Security, IT Assets and Project Management<\/td>ISO 10006<\/td>Quality management guidance for planning and managing quality in projects.<\/td><\/tr>
75<\/strong><\/td>Cloud Security, IT Assets and Project Management<\/td>ISO 21502<\/td>Project management guidance covering initiation, planning, management, and closure.<\/td><\/tr>
76<\/strong><\/td>Cloud Security, IT Assets and Project Management<\/td>PRINCE2 (Projects IN Controlled Environments)<\/td>A structured project management method emphasizing governance, business justification, and staged delivery.<\/td><\/tr>
77<\/strong><\/td>Requirements, Architecture and Software Quality<\/td>ISO\/IEC\/IEEE 29148<\/td>A requirements engineering standard covering stakeholder needs, specifications, and traceability.<\/td><\/tr>
78<\/strong><\/td>Requirements, Architecture and Software Quality<\/td>ISO\/IEC\/IEEE 42010<\/td>A standard for describing and communicating system, software, and enterprise architectures.<\/td><\/tr>
79<\/strong><\/td>Requirements, Architecture and Software Quality<\/td>ISO\/IEC\/IEEE 15289<\/td>A standard defining the purpose and content of systems and software lifecycle information items.<\/td><\/tr>
80<\/strong><\/td>Requirements, Architecture and Software Quality<\/td>IEEE 1012-2024<\/td>A verification and validation standard assessing whether systems, software, and hardware meet their requirements.<\/td><\/tr>
81<\/strong><\/td>Requirements, Architecture and Software Quality<\/td>ISO\/IEC\/IEEE 15939<\/td>An engineering measurement process standard supporting definition, collection, and interpretation of metrics.<\/td><\/tr>
82<\/strong><\/td>Requirements, Architecture and Software Quality<\/td>ISO\/IEC 5055<\/td>A standard for automated source-code measures of structural software quality.<\/td><\/tr>
83<\/strong><\/td>Requirements, Architecture and Software Quality<\/td>ISO\/IEC 25023<\/td>A standard specifying measures for evaluating system and software product quality.<\/td><\/tr>
84<\/strong><\/td>Requirements, Architecture and Software Quality<\/td>ISO\/IEC 25040:2024<\/td>A quality evaluation framework for ICT products, software, data, and IT services.<\/td><\/tr>
85<\/strong><\/td>Requirements, Architecture and Software Quality<\/td>ISO\/IEC\/IEEE 24748-1<\/td>Guidance for lifecycle management and application of systems and software engineering processes.<\/td><\/tr>
86<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>IATF 16949<\/td>An automotive quality management standard emphasizing defect prevention and continual improvement.<\/td><\/tr>
87<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>VDA 6.3<\/td>An automotive process audit methodology for evaluating development, production, and supplier risks.<\/td><\/tr>
88<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>Automotive Core Tools (APQP, Control Plan, PPAP, FMEA, MSA, SPC)<\/td>A collection of automotive quality planning, risk prevention, measurement, and approval methods.<\/td><\/tr>
89<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>ISO 21448 (SOTIF)<\/td>An automotive safety standard addressing hazards from functional insufficiencies and foreseeable misuse.<\/td><\/tr>
90<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>ISO 24089<\/td>An automotive software update engineering standard for managing and validating vehicle software updates.<\/td><\/tr>
91<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>UNECE UN Regulation No. 155 (UN R155)<\/td>A vehicle cybersecurity regulation requiring cybersecurity management and applicable vehicle approvals.<\/td><\/tr>
92<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>UNECE UN Regulation No. 156 (UN R156)<\/td>A vehicle software update regulation covering update management and applicable approvals.<\/td><\/tr>
93<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>ISO\/PAS 8800<\/td>An automotive specification addressing safety-related risks and assurance of AI in road vehicles.<\/td><\/tr>
94<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>ISO\/TS 5083<\/td>A technical specification for safety engineering and validation of automated driving systems.<\/td><\/tr>
95<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>ISO 34502<\/td>A scenario-based safety evaluation framework for automated driving systems.<\/td><\/tr>
96<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>ISO 34503<\/td>A standard for specifying an automated driving system’s operational design domain.<\/td><\/tr>
97<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>EN 50716<\/td>A railway software development standard replacing EN 50128 and EN 50657.<\/td><\/tr>
98<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>EN 50126<\/td>A railway standards family addressing reliability, availability, maintainability, and safety (RAMS).<\/td><\/tr>
99<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>EN 50129<\/td>A railway safety standard for safety-related electronic systems used in signalling.<\/td><\/tr>
100<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>ISO 14971<\/td>A medical device standard for identifying hazards, evaluating risks, and implementing controls.<\/td><\/tr>
101<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>IEC 62366-1<\/td>A medical device usability engineering standard addressing use-related safety risks.<\/td><\/tr>
102<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>IEC 81001-5-1<\/td>A health software standard defining security activities throughout the product lifecycle.<\/td><\/tr>
103<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>IEC 82304-1<\/td>A health software product standard for safety, security, and lifecycle requirements.<\/td><\/tr>
104<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>IEC 61511<\/td>A functional safety standard for safety-instrumented systems in process industries.<\/td><\/tr>
105<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>IEC 62061<\/td>A functional safety standard for machinery safety-related control systems.<\/td><\/tr>
106<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>SAE ARP4754B<\/td>Aerospace guidance on aircraft and system development assurance and verification.<\/td><\/tr>
107<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>SAE ARP4761A<\/td>Aerospace guidance on safety assessment methods and aircraft system hazards.<\/td><\/tr>
108<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>RTCA DO-326A \/ EUROCAE ED-202A<\/td>Airworthiness security guidance for aircraft system cybersecurity risk and assurance.<\/td><\/tr>
109<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>ECSS-E-ST-40C Rev.1<\/td>A European space standard defining software engineering requirements for space projects.<\/td><\/tr>
110<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>ECSS-Q-ST-80C Rev.2<\/td>A European space standard for software product assurance and quality activities.<\/td><\/tr>
111<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>AS9100 \/ IAQG 9100<\/td>An aerospace quality management standard supplementing ISO 9001 with sector-specific requirements.<\/td><\/tr>
112<\/strong><\/td>Automotive, Railway, Aerospace, Medical and Industrial Standards<\/td>AIAG CQI-34 (Software Assurance Approval Process \/ SwAAP)<\/td>An automotive industry manual for structured software assurance and approval practices.<\/td><\/tr>
113<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>ISO\/IEC 27002<\/td>Guidance on implementing organizational, people, physical, and technological security controls.<\/td><\/tr>
114<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>ISO\/IEC 27005<\/td>Guidance for information security risk assessment, treatment, and monitoring.<\/td><\/tr>
115<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>ISO\/IEC 27035 Series<\/td>A family of standards for preparing for, detecting, handling, and learning from security incidents.<\/td><\/tr>
116<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>ISO\/IEC 27036 Series<\/td>A family of standards addressing security risks in supplier and supply-chain relationships.<\/td><\/tr>
117<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>ISO\/IEC 27031:2025<\/td>Guidance on ICT readiness to support business continuity.<\/td><\/tr>
118<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>ISO\/IEC 27034 Series<\/td>A family of standards for integrating security into application development and management.<\/td><\/tr>
119<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>ISO\/IEC 29147<\/td>Guidelines for receiving, coordinating, and communicating vulnerability disclosures.<\/td><\/tr>
120<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>ISO\/IEC 30111<\/td>Guidelines for analyzing, remediating, and coordinating reported product vulnerabilities.<\/td><\/tr>
121<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>ISO\/IEC 15408 (Common Criteria)<\/td>A framework for specifying and independently evaluating IT product security properties.<\/td><\/tr>
122<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>ISO\/IEC 29100<\/td>A privacy framework defining principles and terminology for protecting personal information.<\/td><\/tr>
123<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>ISO\/IEC 29134<\/td>Guidelines for conducting privacy impact assessments and managing processing risks.<\/td><\/tr>
124<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>NIST SP 800-37 (Risk Management Framework)<\/td>A process for categorizing systems, selecting controls, assessing security, authorization, and monitoring.<\/td><\/tr>
125<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>NIST SP 800-61 Rev.3<\/td>Incident response guidance integrated with broader cybersecurity risk management.<\/td><\/tr>
126<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>NIST SP 800-207 (Zero Trust Architecture)<\/td>An architecture guideline emphasizing continuous verification and least-privilege access.<\/td><\/tr>
127<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>NIST SP 800-161 Rev.1<\/td>Cybersecurity supply-chain risk management guidance for suppliers, products, and services.<\/td><\/tr>
128<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>NIST SP 800-171 Rev.3<\/td>Security requirements for controlled unclassified information in nonfederal systems.<\/td><\/tr>
129<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>CIS Critical Security Controls v8.1<\/td>Prioritized safeguards for reducing common cybersecurity threats.<\/td><\/tr>
130<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>CIS Benchmarks<\/td>Community-developed secure configuration guidance for systems, applications, and cloud services.<\/td><\/tr>
131<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>CSA Cloud Controls Matrix (CCM)<\/td>A cloud security control framework supporting compliance, risk assessment, and shared responsibility.<\/td><\/tr>
132<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>NIST Privacy Framework<\/td>A voluntary framework for managing privacy risks associated with personal data processing.<\/td><\/tr>
133<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>MITRE ATT&CK<\/td>A knowledge base of adversary tactics and techniques for threat modeling and detection.<\/td><\/tr>
134<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>OWASP Top 10:2025<\/td>A security awareness reference identifying major categories of web application risks.<\/td><\/tr>
135<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>OWASP API Security Top 10<\/td>A security reference identifying major application programming interface risks.<\/td><\/tr>
136<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>SLSA (Supply-chain Levels for Software Artifacts)<\/td>A framework of assurance levels for software build integrity and provenance.<\/td><\/tr>
137<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>OpenSSF OSPS Baseline<\/td>Security requirements for open-source projects organized by maturity levels.<\/td><\/tr>
138<\/strong><\/td>Advanced Cybersecurity, Privacy and Supply-Chain Security<\/td>TISAX \/ VDA ISA<\/td>An automotive information security assessment and assurance scheme for supplier relationships.<\/td><\/tr>
139<\/strong><\/td>AI Governance and Data Management<\/td>NIST AI Risk Management Framework (AI RMF)<\/td>A voluntary framework for governing, mapping, measuring, and managing AI risks.<\/td><\/tr>
140<\/strong><\/td>AI Governance and Data Management<\/td>NIST AI 600-1 (Generative AI Profile)<\/td>A NIST AI RMF companion profile addressing generative AI-specific risks.<\/td><\/tr>
141<\/strong><\/td>AI Governance and Data Management<\/td>ISO\/IEC 42005<\/td>Guidance for assessing and documenting impacts of AI systems on people and society.<\/td><\/tr>
142<\/strong><\/td>AI Governance and Data Management<\/td>ISO\/IEC 42006<\/td>Additional requirements for organizations that audit and certify AI management systems.<\/td><\/tr>
143<\/strong><\/td>AI Governance and Data Management<\/td>ISO\/IEC 5338<\/td>A standard defining lifecycle processes for AI-enabled systems.<\/td><\/tr>
144<\/strong><\/td>AI Governance and Data Management<\/td>ISO\/IEC 22989<\/td>Foundational AI concepts, terminology, and classifications.<\/td><\/tr>
145<\/strong><\/td>AI Governance and Data Management<\/td>ISO\/IEC 23053<\/td>A framework describing machine-learning-based AI system components and interactions.<\/td><\/tr>
146<\/strong><\/td>AI Governance and Data Management<\/td>ISO\/IEC 5259 Series<\/td>A standards family covering data quality for analytics and machine learning.<\/td><\/tr>
147<\/strong><\/td>AI Governance and Data Management<\/td>ISO\/IEC 25059<\/td>A quality model defining characteristics used to evaluate AI systems.<\/td><\/tr>
148<\/strong><\/td>AI Governance and Data Management<\/td>ISO\/IEC 25012<\/td>A data quality model defining characteristics for assessing data within information systems.<\/td><\/tr>
149<\/strong><\/td>AI Governance and Data Management<\/td>DAMA-DMBOK (Data Management Body of Knowledge)<\/td>A reference framework covering data governance, architecture, quality, security, and integration.<\/td><\/tr>
150<\/strong><\/td>AI Governance and Data Management<\/td>EDM Council DCAM (Data Management Capability Assessment Model)<\/td>A capability assessment model for enterprise data management governance and controls.<\/td><\/tr>
151<\/strong><\/td>AI Governance and Data Management<\/td>EDM Council CDMC (Cloud Data Management Capabilities)<\/td>A framework defining controls for securely managing data in cloud environments.<\/td><\/tr>
152<\/strong><\/td>AI Governance and Data Management<\/td>OWASP Top 10 for LLM \/ Generative AI Applications<\/td>A security reference highlighting common vulnerabilities in large language model applications.<\/td><\/tr>
153<\/strong><\/td>Enterprise Architecture, Project Management and DevOps<\/td>TOGAF Standard, 10th Edition<\/td>An enterprise architecture framework for designing, governing, and evolving enterprise architectures.<\/td><\/tr>
154<\/strong><\/td>Enterprise Architecture, Project Management and DevOps<\/td>ArchiMate<\/td>A modeling language for visualizing enterprise architecture elements and relationships.<\/td><\/tr>
155<\/strong><\/td>Enterprise Architecture, Project Management and DevOps<\/td>IT4IT Reference Architecture<\/td>A reference architecture for IT value streams and digital product and service operating models.<\/td><\/tr>
156<\/strong><\/td>Enterprise Architecture, Project Management and DevOps<\/td>PMBOK Guide, Eighth Edition<\/td>A PMI project management reference providing principles, domains, and practices for project delivery.<\/td><\/tr>
157<\/strong><\/td>Enterprise Architecture, Project Management and DevOps<\/td>ISO 21503<\/td>International guidance for managing programmes of related initiatives.<\/td><\/tr>
158<\/strong><\/td>Enterprise Architecture, Project Management and DevOps<\/td>ISO 21504<\/td>International guidance for managing organizational portfolios of projects and programmes.<\/td><\/tr>
159<\/strong><\/td>Enterprise Architecture, Project Management and DevOps<\/td>FinOps Framework<\/td>A financial management framework for optimizing cloud and other technology expenditure.<\/td><\/tr>
160<\/strong><\/td>Enterprise Architecture, Project Management and DevOps<\/td>Site Reliability Engineering (SRE)<\/td>An engineering discipline using automation, SLOs, and measurement to improve service reliability.<\/td><\/tr>
161<\/strong><\/td>Enterprise Architecture, Project Management and DevOps<\/td>DORA Software Delivery Performance Metrics<\/td>Research-based metrics for software delivery throughput, stability, and improvement.<\/td><\/tr>
162<\/strong><\/td>Quality Auditing, Compliance and Sustainability<\/td>ISO 19011:2026<\/td>Guidance for management system auditing, audit programmes, and auditor competence.<\/td><\/tr>
163<\/strong><\/td>Quality Auditing, Compliance and Sustainability<\/td>ISO 9004<\/td>Guidance for sustained organizational success and long-term quality management improvement.<\/td><\/tr>
164<\/strong><\/td>Quality Auditing, Compliance and Sustainability<\/td>IEC 31010<\/td>A collection of techniques for assessing and analyzing risks.<\/td><\/tr>
165<\/strong><\/td>Quality Auditing, Compliance and Sustainability<\/td>ISO 37301<\/td>A compliance management system standard for designing, operating, and improving compliance programmes.<\/td><\/tr>
166<\/strong><\/td>Quality Auditing, Compliance and Sustainability<\/td>ISO 37001<\/td>An anti-bribery management system standard for preventing, detecting, and addressing bribery.<\/td><\/tr>
167<\/strong><\/td>Quality Auditing, Compliance and Sustainability<\/td>ISO\/TS 22317<\/td>Guidance for conducting structured business impact analyses.<\/td><\/tr>
168<\/strong><\/td>Quality Auditing, Compliance and Sustainability<\/td>ISO 22361<\/td>Guidance for preparing for, responding to, and learning from crises.<\/td><\/tr>
169<\/strong><\/td>Quality Auditing, Compliance and Sustainability<\/td>ISO 55001<\/td>An asset management system standard for managing asset value, performance, and risk.<\/td><\/tr>
170<\/strong><\/td>Quality Auditing, Compliance and Sustainability<\/td>ISO 14064-1<\/td>A standard for quantifying and reporting organizational greenhouse gas emissions and removals.<\/td><\/tr><\/tbody><\/table><\/figure>\n","protected":false},"excerpt":{"rendered":"

No. Category Standard \/ Framework One-Line Introduction 1 Software Process Improvement and Testing Maturity Automotive SPICE (ASPICE) An automotive process assessment model used to evaluate and improve… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[11138],"tags":[],"class_list":["post-79613","post","type-post","status-publish","format-standard","hentry","category-best-tools"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/79613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=79613"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/79613\/revisions"}],"predecessor-version":[{"id":79614,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/79613\/revisions\/79614"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=79613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=79613"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=79613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}