Reviewed 25 October 2026
Application evidence for your compliance programme.
The applications your people use can access sensitive information, introduce software dependencies and support important business processes. Understanding those risks is part of effective security, privacy and supplier oversight.
MobSTR brings mobile app and browser extension assessments, security ratings and ongoing monitoring into that work. OpenGates extends the review to third party Microsoft Teams apps, while InterroPol adds privacy policy intelligence. The sections below explain how this evidence can support specific requirements across regulations, assurance frameworks and security standards.
Alignment means supporting relevant requirements with evidence and ongoing review. Your organisation remains responsible for determining which obligations apply, implementing the necessary controls and demonstrating compliance. The scope of each assessment depends on the application, platform, version and business use.
Data protection law · UK & EU
GDPR: make informed decisions about personal data
UK GDPR and EU GDPR require organisations to consider how personal data is used and protected. For application decisions, relevant duties include data protection by design and by default under Article 25, security of processing under Article 32, and Data Protection Impact Assessments under Article 35 where processing is likely to create a high risk to individuals.
How MobSTR helps
MobSTR helps teams examine permissions, security weaknesses and dependencies before approving an app and as it changes. Together with InterroPol’s analysis of privacy policy statements, these findings help you question what information an application may access, how its stated handling compares with available technical evidence, and whether further supplier assurances or restrictions are needed. Use the evidence to inform DPIAs, document decisions and prioritise security improvements.
An assessment provides inputs to your privacy review. Your organisation must still establish a lawful basis, assess necessity and proportionality, manage individual rights and address any applicable contractual or international transfer requirements. A permission alone does not prove that data has been collected or transferred.
Financial services regulation · EU
DORA: strengthen oversight of application dependencies
The Digital Operational Resilience Act has applied since 17 January 2025 to financial entities within its scope. It addresses ICT risk management, incident reporting, resilience testing and ICT third party risk. Article 8 concerns the identification of ICT assets, dependencies and risks, while Article 28 sets principles for managing ICT third party relationships.
DORA also calls for ongoing ICT risk identification and continuous monitoring of ICT security. Its supporting technical standards require the scope and frequency of automated vulnerability scanning to reflect asset classification and risk.
How MobSTR helps
Mobile apps, browser extensions and third party apps inside business platforms can introduce dependencies that deserve a place in that assessment. MobSTR helps teams review vulnerabilities, permissions and software components, monitor changes and prioritise further investigation. Relating these findings to the data and business functions an application supports can inform supplier due diligence, application approvals and the evidence presented to risk committees.
App assessments contribute to a wider DORA programme. They do not replace the register of ICT contractual arrangements, contract reviews, business continuity planning, incident reporting or required resilience testing. The importance of an application or service must be assessed in the organisation’s own context.
Read the practical guide to application evidence for UK financial-services operational resilience ↗
Cybersecurity directive · EU
NIS2: bring applications into supply chain risk management
NIS2 establishes cybersecurity requirements for essential and important entities through national legislation in EU Member States. Article 21 covers risk management measures, including supply chain security and security in the acquisition, development and maintenance of systems, with attention to vulnerability handling.
How MobSTR helps
MobSTR can help organisations assess the applications and software dependencies that sit within their wider technology supply chain. Reviewing permissions, vulnerable components and security findings before adoption helps teams ask better questions of suppliers. Repeat assessments and risk notifications support ongoing review when applications change, with evidence to inform mitigation, continued approval or further investigation.
Applicability depends on the entity, sector, size, jurisdiction and national implementation. App risk evidence supports selected measures; organisations must also address governance, incident handling, service continuity, reporting and the other duties that apply. NIS2 is distinct from the UK’s NIS legislation.
NHS assurance · England / Cyber framework · UK
NHS DSPT and CAF: evidence for application assurance
The NHS Data Security and Protection Toolkit supports assessment of data security and information governance. NHS England’s CAF aligned approach draws on the NCSC Cyber Assessment Framework, including risk management, asset management, supply chain oversight, data security and system security. Organisations should use the assessment requirements applicable to them.
How MobSTR helps
MobSTR gives security and information governance teams evidence to assess the applications used in clinical, administrative and other business workflows. Findings about permissions, vulnerabilities and dependencies help teams review suitability alongside the sensitivity of information and the importance of the service. Assessment records and monitoring can contribute to evidence for CAF areas A2, A3 and A4, and inform work on B3 and B4.
The DSPT is an organisational assessment. MobSTR supports relevant evidence gathering, while the organisation retains responsibility for controls and assurance across its systems and services. Application security findings do not establish clinical safety, medical device conformity or completion of a DTAC assessment.
Information security management standard · International
ISO 27001: connect application findings to your ISMS
ISO/IEC 27001:2022 defines requirements for an information security management system, or ISMS. It asks organisations to manage information security risks through a structured, continuing process. ISO/IEC 27002:2022 provides supporting guidance on information security controls.
How MobSTR helps
MobSTR helps bring application findings into that process. Security assessments, dependency analysis, risk ratings and monitoring can inform risk assessment and treatment decisions for the applications within your scope. Teams can use the evidence to support supplier reviews, prioritise weaknesses and explain why an application was approved, restricted or referred for further investigation. Reviewing findings as software changes helps keep those decisions relevant.
Your organisation must select and implement appropriate controls, maintain its ISMS and demonstrate effectiveness. The evidence MobSTR provides is one input to that work. ISO 27001 certification relates to the defined scope of an organisation’s management system; a scanned app does not become certified.
Cybersecurity risk framework · International use
NIST CSF 2.0: turn application findings into risk decisions
The NIST Cybersecurity Framework 2.0 gives organisations a common way to describe and manage cybersecurity outcomes. It is organised around Govern, Identify, Protect, Detect, Respond and Recover. Relevant areas for application oversight include asset management, risk assessment and cybersecurity supply chain risk management.
How MobSTR helps
MobSTR can contribute visibility of the applications under assessment and evidence of their vulnerabilities, permissions and dependencies. This supports software asset oversight under ID.AM, risk identification and prioritisation under ID.RA, and reviews of supplier products and services under GV.SC. Teams can use the findings to choose proportionate actions and revisit decisions when an application’s risk profile changes.
NIST CSF is a voluntary framework and does not prescribe a particular product. MobSTR supports selected outcomes within a wider programme; its application monitoring does not by itself provide all detection, incident response or recovery capabilities.
Cybersecurity certification schemes · UK
Cyber Essentials: support better software decisions
Cyber Essentials focuses on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus covers the same controls and adds independent technical verification that they are working in practice.
How MobSTR helps
MobSTR can contribute to the application management part of that work by highlighting security weaknesses and vulnerable dependencies in assessed apps. Findings help teams decide which applications need investigation, updates, restrictions or removal, and provide evidence for discussions with suppliers. Ongoing review helps organisations revisit those decisions as applications change.
MobSTR does not implement all five controls or replace the certification assessment. Organisations must confirm software support status, apply required updates, enforce configuration and access policies, and demonstrate compliance across the agreed scope. An app risk score alone is not proof that a Cyber Essentials requirement has been met.
Payment card security standard · International
PCI DSS: assess relevant application security risks
PCI DSS establishes technical and operational requirements to protect payment account data. Its relevance depends on the cardholder data environment and the systems that can affect its security. Application assessment therefore starts with a clear understanding of what is in scope.
How MobSTR helps
Where an assessed application falls within that scope, MobSTR’s vulnerability and dependency findings can inform software security reviews, remediation priorities and supplier discussions. Teams can use the evidence to investigate identified weaknesses, review changes and support the organisation’s wider processes for maintaining secure systems and software.
This is a targeted contribution, not a PCI DSS compliance assessment. MobSTR does not replace required vulnerability scanning, penetration testing, payment software evaluations or validation by the appropriate assessor. Findings must be matched to the relevant PCI DSS requirements and the actual deployment environment.
Application security reference · International
OWASP Mobile Top 10: a shared language for app risk
The OWASP Mobile Top 10 identifies significant categories of mobile application security risk. Its 2024 edition includes supply chain security, privacy controls, secure communication, data storage and cryptography. It provides a useful structure for understanding findings and discussing improvement priorities.
How MobSTR helps
MobSTR maps relevant mobile application findings against the OWASP Mobile Top 10, helping teams connect technical issues with recognised risk categories. That structure can make reports easier to discuss with developers, suppliers, security teams and decision makers. Combined with the application’s business purpose and data access, the findings help prioritise investigation and remediation.
OWASP is a technical reference, not a regulator or a product certification scheme. A mapping does not prove that every risk has been tested or removed. The Mobile Top 10 is also distinct from the more detailed Mobile Application Security Verification Standard, or MASVS; full MASVS coverage requires a separately defined assessment.
Existing NIS duties and proposed reform · UK
UK cyber resilience: prepare with clearer application oversight
The UK’s Network and Information Systems Regulations 2018 place security and resilience duties on organisations providing specified essential and digital services. As checked on 25 October 2026, the Cyber Security and Resilience (Network and Information Systems) Bill remains a proposal progressing through Parliament. It seeks to extend coverage and strengthen the regime, with implementation dependent on the final legislation and commencement arrangements.
How MobSTR helps
Understanding the applications and dependencies that support important services is useful both for existing obligations and preparation for change. MobSTR can help teams identify application weaknesses, review permissions and dependencies, and maintain evidence for decisions about continued use and mitigation. These findings can feed the organisation’s wider service risk and supplier assessments.
Organisations should distinguish current legal duties from proposals and check the latest parliamentary and government guidance. MobSTR provides application risk evidence; it does not determine whether an organisation is in scope or satisfy the full set of resilience and reporting obligations.
Public company disclosure rules · United States
SEC disclosure: give leaders clearer application risk evidence
The US Securities and Exchange Commission’s cybersecurity rules require covered public companies to disclose material cybersecurity incidents and provide information about cybersecurity risk management, strategy and governance. For domestic registrants, an Item 1.05 Form 8-K is generally due four business days after an incident is determined to be material, subject to the rule’s provisions.
How MobSTR helps
MobSTR’s application assessments and monitoring can contribute to the evidence security leaders use to explain exposure, priorities and changes in risk. Understanding which applications support important activities, and what their findings mean in the organisation’s environment, can support clearer management discussions and documented oversight.
Application findings do not determine whether an incident is material and are not a substitute for incident investigation or legal and disclosure processes. The rules do not specifically mandate MobSTR or continuous mobile app scanning. Foreign private issuers have different reporting forms and requirements.
Aviation information security regulation · Europe
EASA Part-IS: consider application risk where safety matters
EASA’s Part-IS framework addresses information security risks that could affect aviation safety. It applies to specified aviation organisations and activities, subject to the regulations’ definitions and exclusions. Requirements cover information security management, risk assessment and treatment, incident handling and reporting, and compliance monitoring.
How MobSTR helps
Where mobile applications or their dependencies form part of a safety relevant environment, MobSTR can provide technical findings for the organisation’s wider assessment. Vulnerability analysis, permission reviews and ongoing monitoring help teams identify issues that need investigation and document the evidence behind mitigation or continued use. Those findings should be considered alongside the operational role of the application and the potential consequences of failure or compromise.
MobSTR supplies application security evidence and does not establish aviation safety compliance or approval. The organisation must determine scope, evaluate safety consequences and fulfil the information security management and reporting obligations that apply to its activities.
Bring your application risks into view.
Talk to us about the frameworks that matter to your organisation. We will show you how MobSTR’s findings, privacy evidence and ongoing monitoring can support your application approval, supplier review and assurance processes.
Explore MobSTR with us