How Drupal modules support specific regulatory requirements, with the requirements quoted from the regulation itself.
Handling GDPR on a Drupal site: recording consent, cookie consent for embedded services, data export and erasure requests with the GDPR module, sanitized database dumps for developers and the gaps modules cannot close.
What the Department of Justice rule means for state and local government Drupal sites: WCAG 2.1 AA, compliance dates by population, what Drupal core provides and the content and theme work that remains.
Which Drupal sites the EAA touches, such as e-commerce and banking services, how WCAG-based conformance is reached on Drupal, and accessibility statements and checks for editors.
Keeping protected health information safe on a Drupal site: Webform submission storage and encryption, routing PHI to systems built for it, access control, audit logging and hosting under a BAA.
Reducing PCI DSS scope for a Drupal Commerce store with hosted payment fields from gateways such as Stripe or Braintree, what the site still owns, and quarterly scanning and patching duties.
The evidence a Drupal platform team must produce for SOC 2 or ISO/IEC 27001: patch timeliness against security advisories, access and role reviews, change management through configuration export, backups and logging.
Where a Drupal site falls inside an organization's NIS2 obligations: vulnerability handling with security advisories, supply chain of contributed modules, incident reporting and hosting security.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.