Frameworks and standards we apply
International standards and recognized frameworks, connected to each of our services.
Frameworks and standards
The frameworks behind every service
We work with international standards and recognized frameworks so every finding, recommendation and expert report is traceable, comparable and defensible.
Governance & risk
ISO/IEC 27001:2022
Information security management system
ISMS requirements: gap assessment, implementation, internal audit and certification readiness.
Governance & risk
ISO/IEC 27002:2022
Information security controls
A catalogue of 93 organizational, people, physical and technological controls that we use as the reference in every assessment.
Applied inGovernance & risk
ISO/IEC 27005:2022
Information security risk management
A method to identify, assess and treat risks, aligned with ISO/IEC 27001.
Governance & risk
NIST CSF 2.0
NIST Cybersecurity Framework
Six functions (Govern, Identify, Protect, Detect, Respond and Recover) that we use as a cross-cutting map of every service.
Governance & risk
ISO 31000:2018
Risk management
A common risk language with senior management and the board.
Applied inGovernance & risk
CIS Controls v8.1
CIS Critical Security Controls
Safeguards prioritized by implementation group; the basis of several Express assessments.
Applied inGovernance & risk
ISO 22301:2019
Business continuity
Continuity and recovery plans that connect incident response with operations.
Applied inPrivacy
ISO/IEC 27701:2025
Privacy information management system
PIMS requirements for controllers and processors, as a standalone system or integrated with ISO/IEC 27001.
Applied inPrivacy
Ley 1581 · LGPD · LFPDPPP
Latin American data protection laws
Colombia, Brazil, Mexico, Chile, Peru, Argentina and the other countries in the region where you operate.
Applied inPrivacy
ISO/IEC 29100
Privacy framework
Privacy principles and terminology that align data protection programs.
Applied inPrivacy
ISO/IEC 29134
Privacy impact assessment
A method for privacy impact assessments (PIA/DPIA) of projects and systems.
Applied inPrivacy
ISO/IEC 27018
Personal data in public clouds
Controls for cloud providers acting as data processors.
Applied inPrivacy
RGPD · CCPA/CPRA
International privacy laws (GDPR, CCPA/CPRA)
For operations involving EU residents or U.S. consumers.
Applied inArtificial intelligence
ISO/IEC 42001:2023
Artificial intelligence management system
Requirements to govern the responsible development, procurement and use of AI.
Applied inArtificial intelligence
ISO/IEC 27090:2026
Cybersecurity for AI systems
Guidance on addressing security threats and compromises to AI systems across their lifecycle.
Applied inArtificial intelligence
ISO/IEC 23894:2023
AI risk management
Guidance to integrate AI risks into enterprise risk management.
Applied inArtificial intelligence
ISO/IEC 42005:2025
AI system impact assessment
How to assess the effects of an AI system on individuals and groups.
Applied inArtificial intelligence
NIST AI RMF 1.0
NIST AI Risk Management Framework
Govern, Map, Measure and Manage functions for trustworthy AI.
Applied inArtificial intelligence
OWASP Top 10 LLM · MITRE ATLAS
Threats to AI applications
Vulnerability and attack-technique catalogues that guide our tests of chatbots, assistants and agents.
Applied inForensics & incidents
ISO/IEC 27037:2012
Identification, collection, acquisition and preservation of digital evidence
The basis of our chain of custody and of evidence admissibility.
Forensics & incidents
ISO/IEC 27041:2015
Suitability of investigative methods
How to ensure forensic methods and tools are fit for each case.
Applied inForensics & incidents
ISO/IEC 27042:2015
Analysis and interpretation of digital evidence
Principles to analyze, interpret and report evidence reproducibly.
Applied inForensics & incidents
ISO/IEC 27043:2015
Incident investigation principles and processes
A process model for digital investigations, from readiness to closure.
Applied inForensics & incidents
ISO/IEC 27050
Electronic discovery (eDiscovery)
Identification, preservation and production of electronically stored information in litigation.
Applied inForensics & incidents
ISO/IEC 27035
Information security incident management
Planning, detection, response and lessons learned.
Applied inForensics & incidents
NIST SP 800-61 Rev. 3
Incident response recommendations
NIST guidance aligned with CSF 2.0 to embed incident response in risk management.
Applied inForensics & incidents
NIST SP 800-86
Forensic techniques in incident response
Integrating forensic analysis into the response process.
Applied inForensics & incidents
RFC 3227
Evidence collection and archiving
Order of volatility and good practice when capturing evidence.
Applied inCyber insurance
BBB · Global Bancaria
Bankers Blanket Bond / Financial Institution Bond
Risk surveys for underwriting fidelity, crime and fraud coverage for financial institutions.
Applied inCyber insurance
Computer Crime
Computer crime
Exposure to fraud through manipulation of systems and electronic transfers.
Applied inCyber insurance
Cyber · Primera parte
First-party coverage
Incident response and forensics, data restoration, business interruption and cyber extortion.
Cyber insurance
Cyber · Terceros
Third-party liability
Privacy and network security liability, regulatory defense and third-party claims.
Applied inTechnical testing
OWASP WSTG · ASVS
Web application testing
Testing guide and application security verification standard.
Applied inTechnical testing
OWASP API Security Top 10
API security
Top authentication, authorization and data exposure risks in APIs.
Applied inTechnical testing
OWASP MASVS · MASTG
Mobile application security
Requirements and testing guide for Android and iOS apps.
Applied inTechnical testing
PTES · NIST SP 800-115
Penetration testing methodology
Planning, reconnaissance, exploitation and reporting phases.
Applied inTechnical testing
CVSS v4.0
Common Vulnerability Scoring System
Standard severity rating for every finding.
Applied in
Cross-cutting map with NIST CSF 2.0
Each service contributes to one or more functions of the framework. Together they cover the full cybersecurity cycle.
| Service | GVGovern | IDIdentify | PRProtect | DEDetect | RSRespond | RCRecover |
|---|---|---|---|---|---|---|
| Digital forensics | Not applicable | Not applicable | Contributes | Not applicable | Contributes | Contributes |
| Incident response | Not applicable | Not applicable | Not applicable | Contributes | Contributes | Contributes |
| Insurers | Contributes | Contributes | Not applicable | Not applicable | Contributes | Contributes |
| Consulting | Contributes | Contributes | Contributes | Not applicable | Not applicable | Contributes |
| Data protection | Contributes | Contributes | Contributes | Not applicable | Contributes | Not applicable |
| AI governance & security | Contributes | Contributes | Contributes | Contributes | Not applicable | Not applicable |
| Pentesting | Not applicable | Contributes | Contributes | Contributes | Not applicable | Not applicable |
| Express services | Not applicable | Contributes | Contributes | Not applicable | Not applicable | Not applicable |
GV GovernID IdentifyPR ProtectDE DetectRS RespondRC Recover
ISO/IEC standards are the property of ISO and IEC. We support implementation and certification readiness; certification is granted by accredited bodies.
Contact
Let’s talk about your case
We respond confidentially. If this is an ongoing incident, say so in the form and we will prioritize your case.
Message sent. We will get back to you shortly.
Please check your details: a name of at least 2 letters, a valid email, a phone with numbers only and the authorization box checked.
You have sent several messages in a row. Please try again in a few minutes or write to lab@antifraude.io.
We could not send the form right now. Please write to lab@antifraude.io.