Finance and Professional Services

For organisations in any sector seeking to standardise processes and manage customer expectations systematically.

For organisations with substantial IT estates and for IT service providers.

For organisations where service interruption is critical, or that are multi-site or critical suppliers.

For organisations that process data, access customer systems or provide cloud services.

For organisations processing personally identifiable information within an ISO 27001 scope.

For people-intensive organisations seeking corporate assurance over HR processes.

For organisations and groups of organisations establishing corporate governance over records.

For organisations seeking to manage institutional knowledge systematically.

For organisations in public procurement, using agents or intermediaries, or selling across multiple countries.

For organisations carrying a broad inventory of regulatory obligations.

For organisations that develop, provide or use artificial intelligence in high-impact contexts.

Swift's Customer Security Programme (CSP) is a mandatory yearly attestation against baseline security controls for all Swift network users.

CPoC lets a merchant's phone or tablet accept contactless payments via its own NFC hardware — PCI SSC put it into a sunset period from 1 May to 31 October 2026.

CRI Profile is named in FFIEC's own sunset statement as one industry resource institutions may consider — not a designated successor to the CAT.

The FFIEC sunset its Cybersecurity Assessment Tool (CAT) on August 31, 2025; it was a voluntary self-assessment, not an examination requirement.

MAS's Guidelines on Risk Management Practices – Technology Risk set best-practice standards for Singapore financial institutions managing technology risk.

MPoC is PCI SSC's standard for accepting PIN and contactless card data on one COTS device, evaluated by PCI-Recognized Laboratories.

P2PE is a PCI SSC standard for point-to-point encrypted payment solutions, validated by independent P2PE Assessors — PCI SSC itself does not mandate it.

PCI 3DS Core is PCI SSC's standard for entities operating ACS, DS or 3DSS environments, assessed by qualified 3DS Assessors — not mandated by PCI SSC itself.

PCI 3DS SDK is PCI SSC's product-level standard for 3DS Software Development Kits, evaluated by PCI-Recognized Laboratories — now in its formal sunset period.

Card Production and Provisioning is two PCI SSC standards — Logical and Physical — assessed by CPSA-P/CPSA-L assessors, with no product listing.

PCI DSS is PCI SSC's data security standard for payment account data; v4.0.1 is the only active version, and no compliance certificate is recognized.

PIN Security is a PCI SSC standard for secure PIN management, assessed by independent Qualified PIN Assessors — PCI SSC itself does not mandate it.

PCI TSP sets requirements for token service providers issuing EMV payment tokens, assessed by specially qualified P2PE Assessors — not mandated by PCI SSC.

RBI's 2016 circular directs scheduled commercial banks (excluding Regional Rural Banks) to build cyber security governance, an SOC, and incident reporting.

Secure SLC Standard is PCI SSC's organization-level standard for a software vendor's secure development lifecycle, assessed by PCI Secure SLC Assessors.

Secure Software Standard is PCI SSC's product-level standard for payment software, assessed by PCI Secure Software Assessors — successor to the retired PA-DSS.

SPoC lets merchants accept PIN entry on an ordinary smartphone or tablet — PCI SSC put the standard into a formal sunset period from 1 May to 31 October 2026.

CBEST is the Bank of England, PRA and FCA's intelligence-led penetration testing regime for assessing cyber resilience of systemically important firms.

TIBER-EU is the ECB-coordinated, EU-wide framework for threat intelligence-based ethical red-teaming, aligned with DORA's threat-led penetration testing.