Frameworks
Most organizations don't have one requirement. They have many.
The goal is not a separate program for every framework. The goal is to connect those requirements to the controls the organization already uses. NorthStar maps cybersecurity, privacy, federal, state, and industry frameworks to a single control foundation — so your team manages one connected program instead of running a separate project for each obligation.
Core foundations
Built on NIST from the ground up
Every NorthStar program starts with three NIST publications as its foundation. All other frameworks — federal, state, sector, and privacy — are mapped on top so teams manage one program, not many.
NIST Cybersecurity Framework 2.0
The primary lens NorthStar uses to organize your security program. Six functions — Govern, Identify, Protect, Detect, Respond, Recover — give every team a shared language for ownership and progress. It is sector-agnostic by design, which means it works as the organizing structure regardless of what other frameworks apply to your organization.
NIST SP 800-53 Control Catalog
The control catalog that backs every implementation decision in the portal. More than 1,000 controls across 20 families give teams a precise, auditable record of what is implemented, by whom, and with what evidence. When other frameworks map to SP 800-53, NorthStar gives your team a common control foundation for addressing those requirements without rebuilding the program from scratch.
NIST Privacy Framework
Privacy risk belongs in the same operating conversation as cybersecurity risk — not a separate workstream. The Privacy Framework's five functions map directly to your data-handling obligations and sit alongside your security controls in NorthStar, so privacy and security are managed together rather than in parallel.
Coverage by domain
Every obligation, one control baseline
NorthStar maps requirements across six domains onto your NIST control set. When a new obligation appears, it surfaces as a gap in your existing program — not a new spreadsheet.
Federal requirements
FISMA, FedRAMP, CMMC, DFARS, CJIS, and DoD Zero Trust — mapped to your control baseline so federal obligations don't require a separate program.
State & regional obligations
Texas firstTexas leads with TX-RAMP, TAC 202, and DIR requirements. NorthStar maps state statutes to your NIST controls so local obligations are visible alongside federal ones.
Privacy & data protection
50+ international privacy frameworks — GDPR, CCPA/CPRA, VCDPA, PIPEDA, LGPD, APPI, and more — plus a dozen US federal privacy statutes and ongoing US state privacy expansion, all mapped to your existing NIST SP 800-53 control baseline. No separate privacy tool. No duplicate assessments.
Customer assurance & questionnaires
SOC 2, ISO 27001, and common security questionnaire frameworks. Evidence already attached to your controls is reusable across every customer or auditor request — you are not rebuilding it each time.
Industry & sector standards
HIPAA, HITECH, GLBA, SEC Cybersecurity Rules, NAIC 668, FINRA, DORA, and more — sector-specific requirements mapped to the same control foundation.
Incident readiness
CIRCIA, NERC CIP, CISA CPG, and C2M2 — incident reporting, resilience, and operational technology requirements tracked alongside your broader program.
Privacy & data protection
50+ international privacy frameworks. One control foundation.
Privacy compliance is not a separate program. NorthStar maps international privacy frameworks, US federal privacy statutes, and the rapidly expanding landscape of US state privacy laws directly to the same NIST SP 800-53 control library your security program already runs on.
International frameworks
- GDPR (EU General Data Protection Regulation)
- PIPEDA (Canada)
- LGPD (Brazil)
- APPI (Japan)
- PDPA (Thailand, Singapore)
- POPIA (South Africa)
- 40+ additional international frameworks
US federal privacy statutes
- HIPAA / HITECH
- GLBA (Gramm-Leach-Bliley Act)
- FERPA (student records)
- COPPA (children's online privacy)
- CIPA (children's internet protection)
- FTC Safeguards Rule
- CCPA / CPRA (California)
US state privacy expansion
- VCDPA (Virginia)
- CPA (Colorado)
- CTDPA (Connecticut)
- UCPA (Utah)
- MCDPA (Montana)
- TDPSA (Texas)
- Ongoing expansion — new state laws added as enacted
When a control is satisfied for security, it is satisfied for privacy too.
One program. Every requirement.
NorthStar uses NIST as the common control foundation, then maps your specific obligations on top so teams manage one connected program instead of separate checklists.
See how these frameworks appear inside the portal
Request a demo to see how NorthStar maps your specific obligations to a live control baseline — with evidence, risk, and reporting already connected.