Trust Center · Compliance
Compliance
The frameworks Cystem X aligns its engagements with, and what that alignment means in practice for your program.
Cystem X aligns its security, AI governance and engineering practices with the frameworks listed below. We do not hold, and do not claim to hold, formal certification against any of them: alignment means our practices are designed and operated consistent with each framework's requirements, and can be evidenced through the artifacts a specific engagement produces, such as policies, logs and test results.
Where our alignment work runs deepest
These bars represent relative delivery focus across our practice, not a measured audit score or certification result.
NIST Cybersecurity Framework 2.0
Our security engagements are organized around the Framework's core functions, Govern, Identify, Protect, Detect, Respond and Recover, giving clients a structure that maps cleanly to their own risk reporting.
ISO/IEC 27001:2022
Our information security practices, access control, encryption, incident handling and supplier management, are aligned with the Annex A controls in the current edition of ISO/IEC 27001. Clients pursuing their own certification can use our control evidence as supporting input.
ISO/IEC 42001:2023
AI systems we design and operate follow the management-system structure of ISO/IEC 42001 for AI, covering governance, risk assessment and the lifecycle controls described in our Responsible AI practices.
NIST AI Risk Management Framework
We use the NIST AI RMF's Govern, Map, Measure and Manage functions to structure the AI governance review described on our Responsible AI page.
OWASP ASVS and LLM Top 10
Application security testing follows the OWASP Application Security Verification Standard, and our AI security assessments test specifically against the OWASP Top 10 for LLM Applications, covering risks such as prompt injection, insecure output handling and training data poisoning.
CIS Controls v8
Our baseline infrastructure and endpoint hardening practices are aligned with the CIS Controls v8 safeguards appropriate to each engagement's risk tier.
If an engagement requires independent certification against any of these frameworks, we can support the evidence-gathering and remediation work needed, working alongside your chosen certification body.