Wombat Wombat

Every control, mapped.

A complete overview of Wombat controls, organized by country, regulatory framework and pillar. Validate your infrastructure against 100+ controls across 8 pillars.

Browse by country By framework By pillar Compliance hubs
8 pillars · 100+ controls Static analysis Apache 2.0 · Open source
8
Pillars
100+
Controls
50+
Compliance frameworks
15+
Countries & regions

Controls by country and region.

Wombat controls support compliance with regulations across multiple jurisdictions worldwide.

🇩🇪Germany
29
🇦🇹Austria
25
🇺🇸United States
15
🇫🇷France
14
🇳🇱Netherlands
14
🇬🇧United Kingdom
14
🇦🇺Australia
13
🇨🇭Switzerland
3
🇨🇦Canada
3
🇮🇳India
3
🇧🇷Brazil
3
🇸🇬Singapore
2
Key regional frameworks
GDPR (EU/EEA) NIS2 (EU) DORA (EU Financial) BSI C5/C3A (Germany) ANSSI (France) UK GDPR/NCSC (UK) NIST/FedRAMP (US) ASD Essential 8 (Australia) PIPEDA (Canada) PDPA (Singapore) DPDP Act (India) LGPD (Brazil)

Compliance frameworks.

Wombat maps controls to regulatory frameworks across security, compliance, and governance domains.

International Standards

ISO 27001:2022 ISO 27017 ISO 27018 CIS Controls v8 CSA STAR COBIT 2019

European Frameworks

GDPR NIS2 DORA EUCS (ENISA) BSI C5:2020 BSI C3A:2026 ANSSI SecNumCloud

United Kingdom

UK GDPR UK NCSC CAF UK Cyber Essentials

United States

NIST SP 800-53 FedRAMP CMMC 2.0 HIPAA CCPA SOC 2 Type II PCI DSS v4.0

Asia-Pacific

PDPA SG MEITY CSMP DPDP Act

Industry specific

FinOps Foundation ISO/IEC 20000-1 ITIL 4 ISO/IEC 25010 TOGAF

Cloud frameworks

AWS Well-Architected Azure Well-Architected Google Cloud Framework

Germany specific

BSI C5:2020 BSI C3A:2026 IT-Grundschutz DORA NIS2

France specific

ANSSI SecNumCloud GDPR DORA EUCS

Switzerland specific

BSI C5:2020 GDPR DPDP Act

Total: 50+ regulatory frameworks supported.

Controls by pillar.

Every control includes a machine-readable check for automated validation.

Security WAF-SEC
13 controls · Critical, High severity
WAF-SEC-010 WAF-SEC-020 WAF-SEC-030 WAF-SEC-040 WAF-SEC-050 WAF-SEC-060 WAF-SEC-070 WAF-SEC-080 WAF-SEC-090 WAF-SEC-100 WAF-SEC-110 WAF-SEC-120 WAF-SEC-130
Explore
Cost Optimization WAF-COST
10 controls · High, Medium severity
WAF-COST-010 WAF-COST-020 WAF-COST-030 WAF-COST-040 WAF-COST-050 WAF-COST-060 WAF-COST-070 WAF-COST-080 WAF-COST-090 WAF-COST-100
Explore
Operational Excellence WAF-OPS
10 controls · High, Medium severity
WAF-OPS-010 WAF-OPS-020 WAF-OPS-030 WAF-OPS-040 WAF-OPS-050 WAF-OPS-060 WAF-OPS-070 WAF-OPS-080 WAF-OPS-090 WAF-OPS-100
Explore
Reliability WAF-REL
10 controls · Critical, High severity
WAF-REL-010 WAF-REL-020 WAF-REL-030 WAF-REL-040 WAF-REL-050 WAF-REL-060 WAF-REL-070 WAF-REL-080 WAF-REL-090 WAF-REL-100
Explore
Performance Efficiency WAF-PERF
10 controls · Medium severity
WAF-PERF-010 WAF-PERF-020 WAF-PERF-030 WAF-PERF-040 WAF-PERF-050 WAF-PERF-060 WAF-PERF-070 WAF-PERF-080 WAF-PERF-090 WAF-PERF-100
Explore
Sovereign WAF-SOV · unique to Wombat
10 controls · Critical, High severity
WAF-SOV-010 WAF-SOV-020 WAF-SOV-030 WAF-SOV-040 WAF-SOV-050 WAF-SOV-060 WAF-SOV-070 WAF-SOV-080 WAF-SOV-090 WAF-SOV-100
Explore
Sustainability WAF-SUS
10 controls · High, Medium severity
WAF-SUS-010 WAF-SUS-020 WAF-SUS-030 WAF-SUS-040 WAF-SUS-050 WAF-SUS-060 WAF-SUS-070 WAF-SUS-080 WAF-SUS-090 WAF-SUS-100
Explore
Agentic WAF-AGN · new in v1.1
10 controls · High severity · Identity, governance, guardrails, observability
WAF-AGN-010 WAF-AGN-020 WAF-AGN-030 WAF-AGN-040 WAF-AGN-050 WAF-AGN-060 WAF-AGN-070 WAF-AGN-080 WAF-AGN-090 WAF-AGN-100
Overview Docs
WOMBATpass · CLI tool · v1.1.0

Automated checks for every pillar — Terraform, CDK, and more. Static analysis, no cloud credentials required, results in seconds.

PASS FAIL SKIP
Learn about WOMBATpass

Validate your infrastructure.

Dive into the documentation, validate your infrastructure with WOMBATpass, or join the community to contribute controls.

Install WOMBATpass Read the docs Join the community