Guidance on regulatory and legislative requirements such as UK CS&R, GDPR and DORA, separate from voluntary certification frameworks.