Trust center

This page lists the standards and regulations RAISE refers to, grouped by area: the risk management method (ISO 31000:2018 and IEC 31010:2019), the security controls, development, artificial intelligence, personal data and business continuity. For each one, the tables state the role it plays in the product.

Method and product

Standard or regulation	In RAISE
ISO 31000:2018	RAISE's risk management process, from establishing the context to recording, is built on this standard.
IEC 31010:2019	The risk assessment techniques that accompany ISO 31000. RAISE uses three techniques described in this standard: risk index (B.8.6), Monte Carlo simulation (B.5.10) and risk register (B.10.2).
CycloneDX	The format of the SBOM that comes with every RAISE release: the software bill of materials provided for by the Cyber Resilience Act (Annex I, Part II, point 1) and by practice PS.3.2 of NIST SP 800-218.
OASIS CAP 1.2	The format of the civil-protection and weather warnings RAISE reads.

Product security controls

Standard or regulation	In RAISE
NIST SP 800-53 Rev. 5	The catalogue to which RAISE's security controls are mapped; the control on artificial intelligence refers to the NIST AI RMF.
ISO/IEC 27001:2022	Most of RAISE's controls are linked to the standard through NIST's official crosswalk (OLIR 155).
CIS Benchmarks	The reference for hardening RAISE's containers.

Development and vulnerabilities

Standard or regulation	In RAISE
NIST SP 800-218 (SSDF 1.1)	The reference for RAISE's secure development: tests written before the code (practice PW.8), a code review before the release (PW.7), pinned versions and an SBOM for every release (PS.3.2).
OWASP ASVS 5.0.0, Level 2	The security level set as the goal for RAISE's web application.
Regulation (EU) 2024/2847 (Cyber Resilience Act), Art. 14 and Annex I	RAISE's documented procedure for handling and reporting vulnerabilities and, for Annex I, Part II, point 1, the SBOM that comes with every release.
NIST SP 800-61r3	The documented procedure for handling incidents that affect RAISE.
NIST SP 800-161r1	The reference for supplier risk: the licence of every external source is checked before it is connected.

Artificial intelligence and personal data

Standard or regulation	In RAISE
Regulation (EU) 2024/1689 (AI Act)	The reference for transparency (Art. 50) and AI literacy (Art. 4).
NIST AI RMF 1.0	The risk assessment of RAISE's AI functions is organised by the Govern, Map, Measure and Manage functions.
ISO/IEC 42001:2023	One of the sources of RAISE's control on artificial intelligence, alongside the AI Act and NIST AI RMF.
Regulation (EU) 2016/679 (GDPR) and the Italian privacy code	The measures in RAISE include data minimisation, records of processing and the removal of location and device data from photos.

Continuity and security measures

Standard or regulation	In RAISE
ISO 22301:2019 and NIST SP 800-34r1	Business continuity for RAISE itself (a plan, recovery times and tests) is being defined with these standards as the reference.
Directive (EU) 2022/2555 (NIS2), Art. 21	The security measures set out in the article are used as a checklist for RAISE itself.