Frameworks
Pentforge holds no certifications of its own. These are the standards, regulations, and frameworks our engagements are designed around — what each one covers, and a link to the official source.
Requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS) — a risk-managed approach to preserving the confidentiality, integrity, and availability of information.
View framework →Consensus-based, prescriptive secure-configuration guides for specific technologies — operating systems, cloud providers, software, and network devices — developed and maintained through a community consensus process.
View framework →Protection of natural persons with regard to the processing of personal data, and rules on the free movement of personal data within the EU.
View framework →Measures for a high common level of cybersecurity across the EU: cybersecurity risk-management obligations, incident-reporting requirements, and supervision for essential and important entities.
View framework →ICT risk management, incident reporting, digital operational resilience testing, and oversight of ICT third-party providers for the financial sector.
View framework →A framework of security requirements for architecting, designing, building, testing, and verifying secure web application technical security controls — used as a basis for testing web application technical security controls and as a requirements list for secure development.
View framework →A voluntary framework of standards, guidelines, and best practices for managing and reducing cybersecurity risk, organized as a taxonomy of high-level cybersecurity outcomes.
View framework →A prioritized list of the most critical security risk categories specific to large language model (LLM) applications, raising awareness of LLM-specific threats such as prompt injection and excessive agency.
View framework →A voluntary framework to help organizations manage risks from AI systems and incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems.
View framework →Harmonised rules for the development, placing on the market, putting into service, and use of AI systems in the EU, using a risk-based approach: Chapter II prohibits certain AI practices outright, Chapter III sets requirements for high-risk AI systems, and Chapter V addresses general-purpose AI models.
View framework →Horizontal cybersecurity requirements for products with digital elements placed on the EU market, covering the whole product lifecycle from design through vulnerability handling and end-of-support.
View framework →A globally accessible knowledge base of adversary tactics and techniques based on real-world observations, used as a foundation for threat models and detection strategies across the private sector, government, and the cybersecurity product and service community.
View framework →Requirements for establishing, implementing, maintaining, and continually improving an AI management system (AIMS) within an organization that provides or uses AI-based products or services.
View framework →A globally accessible, living knowledge base of adversary tactics and techniques involving AI — including attacks against AI-enabled systems, abuse or manipulation of AI capabilities, and harmful autonomous behavior materially enabled by AI — based on real-world observations and realistic red-team demonstrations. Modeled after and complementary to MITRE ATT&CK, with several tactics and techniques adapted directly from the ATT&CK Enterprise matrix.
View framework →