116 free compliance generators — no account required
ComplyKit has added two more free compliance generators: the APRA CPS 230 Operational Risk Management Compliance Checker (115th) and the NIST SP 800-53 Rev 5 Security Controls Gap Assessment (116th). Both tools are live now at /generate.
APRA CPS 230 Operational Risk Management Compliance Checker (115th generator)
APRA CPS 230 became effective 1 July 2025, replacing the previous CPS 231 (Outsourcing) and CPS 232 (Business Continuity Management) standards. It applies to all APRA-regulated entities — banks, insurers, and superannuation trustees. The APRA CPS 230 Compliance Checker covers all 42 key obligations across six domains:
- Operational Risk Management Framework (CPS 230 §16–24): Board approval and oversight of ORM framework, Senior Management accountability, risk appetite statement, risk identification and assessment methodology, risk register maintenance, three lines of defence model implementation
- Business Continuity Planning (CPS 230 §25–37): Board-approved BCP, critical operations identification, MTPD and RTO for each critical operation, recovery strategies with annual testing, BCP scenario testing programme, succession planning for critical roles, crisis management and communications plan
- Material Service Provider Management (CPS 230 §38–57): MSP register with materiality criteria, Board-approved MSP policy, written agreements with all MSPs, APRA access clause in MSP contracts, due diligence and ongoing monitoring, concentration risk management, exit strategy for each MSP supporting critical operations
- Incident Management & Reporting (CPS 230 §58–67): Incident identification and recording, severity classification and escalation, 72-hour APRA notification process, root cause analysis for material incidents, incident metrics reporting to Board, lessons learned integration, near-miss analysis
- Controls Effectiveness & Assurance (CPS 230 §68–76): Control library and mapping, control effectiveness testing programme, Risk and Control Self-Assessment (RCSA), independent internal audit review, Key Risk Indicators (KRIs) with thresholds, scenario analysis, external validation
- Board & Senior Management Governance (CPS 230 §77–86): Board Risk Committee with CPS 230 mandate, Chief Risk Officer independence, OR reporting to Board, annual self-assessment signed by CEO and CRO, OR framework in major decisions, OR culture assessment, CPS 230 transition confirmation
Who it's for: compliance and risk professionals at APRA-regulated entities (ADIs, insurers, RSE licensees); Chief Risk Officers and their teams; internal audit functions conducting CPS 230 reviews; external consultants advising Australian financial institutions; boards and senior management seeking structured CPS 230 self-assessments.
NIST SP 800-53 Rev 5 Security Controls Gap Assessment (116th generator)
NIST SP 800-53 Rev 5 is the foundational security controls catalogue for US federal information systems and is used as the basis for FedRAMP, FISMA, and increasingly by private sector organisations seeking a comprehensive security framework. The NIST 800-53 Rev 5 Gap Assessment covers 42 key controls across six domains:
- Access Control (AC) & Identification and Authentication (IA): Access control policy and account management, least privilege with RBAC, multi-factor authentication (FIPS 140-3), remote access encryption and monitoring, session lock after inactivity, separation of duties
- Audit & Accountability (AU) and Configuration Management (CM): Audit event definition, audit log protection and integrity, SIEM-based audit review, baseline configuration documentation, change control with security impact analysis, software allowlisting, 3-year audit log retention
- Incident Response (IR) and Contingency Planning (CP): IR policy and plan including US-CERT reporting, 24/7 incident handling capability, annual IR testing, contingency plan with BIA/RTO/RPO, regular backup with integrity verification, annual CP testing, alternate processing site for Moderate/High systems
- Risk Assessment (RA) and Supply Chain Risk Management (SR): Formal risk assessment with threat/likelihood/impact analysis, monthly vulnerability scanning with critical CVE ≤30-day remediation, annual penetration testing, SCRM policy and critical supplier identification (EO 14028), secure acquisition with provenance verification, criticality analysis, threat intelligence integration
- System & Communications Protection (SC) and Media Protection (MP): Network boundary protection with deny-all/allow-by-exception, FIPS 140-3 validated cryptographic modules, TLS 1.2+ encryption in transit, FIPS-approved encryption at rest, DoS/DDoS protection, NIST SP 800-88 media sanitization, MDM with remote wipe capability
- Security Programme Governance (PL/PM/SA/SI): System Security Plan (SSP) covering all 18 mandatory sections, 3PAO assessment and POA&M maintenance, annual security awareness and role-based training, security requirements in acquisition contracts, CISA KEV catalogue monitoring with ≤30-day critical patch SLA, EDR anti-malware deployment, continuous monitoring programme
Who it's for: Cloud Service Providers pursuing FedRAMP authorization; US federal agencies conducting FISMA assessments; defense contractors seeking DFARS/CMMC alignment; state and local government entities implementing security programmes; enterprise security teams using NIST 800-53 as their internal framework; 3PAOs and security consultants conducting gap assessments.
Browse all 116 generators
All 116 free compliance generators are at /generate. No account required. Covers GDPR, CCPA, SOC 2, HIPAA, ISO 27001/27701, EU AI Act (GPAI + High-Risk), NIS2, DORA, PSD2/PSD3, FCA Consumer Duty, CSRD, CRA, NIST CSF 2.0, NIST AI RMF, NIST SP 800-53 Rev 5, CMMC 2.0, Digital Markets Act, EU Data Governance Act, EU Data Act, ePrivacy, AI Fairness, SOC 2 Trust Services Criteria, US State Privacy Laws, APRA CPS 230, APRA CPS 234, and more.