oak9 incorporates your compliance and regulatory requirements to provide security design guidance for your application. We have out-of-the box support for a number of industry standards, compliance frameworks and regulatory requirements that you want your application to adhere to.

Selecting your compliance objectives is an important step in ensuring that oak9 understands the business context of your application. If your organization provides services within a unique regulatory environment, this will drive unique security requirements that oak9 will ensure your application addresses. Some compliance frameworks have different levels of rigor (e.g., NIST SP 800-53 has High, Medium and Low levels; HITRUST has increasing levels of rigor from 1-3). oak9 will ensure that your application architecture aligns with the security requirements of a given industry standard or compliance framework to satisfy the level of security rigor required.

Another advantage of selecting the applicable compliance objectives is that oak9 will provide visibility into how your application architecture is fulfilling your compliance objectives. Design gaps will be mapped to selected compliance objectives along with oak9’s technical security requirements. Oak9 can generate reports for auditors and compliance professionals to provide real time compliance and security information about your application.

Selecting “Not Sure” under compliance objectives will skip the validation of regulation-specific requirements but will still assess for design gaps and validate security best practices. You can add or change the compliance objectives at any time by going to your project’s page and clicking the edit button near compliance objectives.

Compliance frameworks supported by oak9:

Compliance Framework



CSF or "Common Security Framework", the HITRUST CSF is a prescriptive set of controls that meet the requirements of multiple regulations and standards. It leverages internationally accepted standards and regulations such as GDPR, ISO, NIST, PCI, and HIPAA to create a comprehensive set of baseline security and privacy controls.

NIST SP 800-53 r4

This publication provides a catalog of security and privacy controls for federal information systems. The controls address a diverse set of security and privacy requirements across the federal government and critical infrastructure, derived from legislation, executive orders, policies, directives, regulations, standards, and/or mission/business needs.


The Health Insurance Portability and Accountability Act of 1996 (HIPAA) mandates industry-wide standards for health care information on electronic billing and other processes and requires the protection and confidential handling of protected health information. The HITECH Act, published in 2013, made several changes to HIPAA and introduced new requirements for HIPAA-covered entities with notable changes for business associates.


The General Data Protection Regulation (GDPR) is a legal framework that sets guidelines for the collection and processing of personal information from individuals who live in the European Union. Since the Regulation applies regardless of where websites are based, it must be implemented by all sites that have European visitors, even if they don't specifically market goods or services to EU residents.

PCI DSS v3.2.1

The Payment Card Industry Data Security Standard is an information security standard for organizations that handle branded credit cards from the major card providers. The standard was created to increase controls around cardholder data to reduce credit card fraud.

ISO 27001

ISO 27001 is an international standard that helps organizations manage the security of their information assets. It provides a management framework for implementing an information security management system to ensure the confidentiality, integrity, and availability of all corporate data such as financial information, intellectual property, employee details or information managed by third parties.

Did this answer your question?