Compliance Standards for Digital Services Act (DSA)

Specifies requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS). Provides a systematic approach to managing sensitive company information.

Extends ISO 27001 and ISO 27002 with specific requirements and guidance for establishing, implementing, maintaining and continually improving a Privacy Information Management System (PIMS). Maps directly to GDPR requirements and provides a certifiable framework for privacy compliance.

Provides principles, framework and process for managing risk. Essential for DSA's risk-based approach to online platform governance, systemic risk identification, and risk mitigation measures. Applies to all types of risks regardless of nature.

Provides guidance for managing risks specific to AI systems including algorithmic bias, transparency, accountability, and safety. Critical for DSA platforms using AI-based recommender systems or content moderation (Articles 27, 35) to assess and mitigate AI-specific risks.

Audit framework for assessing security, availability, processing integrity, confidentiality, and privacy of service organization systems. Essential for DSA transparency and accountability obligations, providing independent assurance reports required by Articles 37, 40, 42.

Collection of practical guidelines and best practices published by ENISA covering IoT security, vulnerability disclosure, supply chain security, and incident handling aligned with EU regulatory requirements.

Specifies requirements for a business continuity management system (BCMS) to protect against, prepare for, respond to, and recover from disruptive incidents. Essential for maintaining critical operations during cybersecurity incidents.

Provides guidelines for information security incident management, including preparation, detection, assessment, response, and lessons learned. Covers the complete incident lifecycle from planning to post-incident activities.