Skip to content

CAPTCHA

What is CAPTCHA?

A challenge-response test used to determine whether a user is human or an automated bot. CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart.

Information Security

Frameworks that govern captcha

ISO 27001:2022View framework →NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →

What the standards actually require on captcha

Requirements naming captcha across 5 standards, quoted from the control text.

WCAG 2.22 controls

For prerecorded audio-only content that is mainly foreground speech (not a CAPTCHA, audio logo or musical vocalisation), there is no background sound, or it can be switched off, or it sits at least 20 dB below the speech apart from occasional sounds of one or...

wcag-22::1.4.7 · Low or No Background Audio (Level AAA) →
EN 301 549 - Accessibility requirements for ICT products and services1 control

A non-web document (one that is not a web page and neither embedded in nor rendered with one) must meet the document versions of WCAG 2.1 guideline 1.1 (text alternatives).

en-301-549-ict-accessibility-requirements::10.1.1 · 10.1.1 Text alternatives →
ISO 27002:20221 control

Secure authentication technologies and procedures are to be put in place, driven by the information access restrictions and the access control policy.

iso-27002-2022::8.5 · Secure authentication →
ITU-T X.805 - Security Architecture for End-to-End Communications1 control

Security Dimension 7 Availability per X.805 Clause 6.7: Availability means that events affecting the network do not stop authorized users from reaching the services, applications, information flows, stored information and network elements they are entitled to....

X805-Dim7-Availability-Network-Resources-Information-Authorized-Access-No-Service-Denial · ITU-T X.805 Security Dimension 7 - Availability + Network Resources + Information Accessible to Authorized Users + Denial-of-Service Prevention + Resilience + Redundancy + Disaster Recovery + Business Continuity + DDoS Mitigation →
OWASP API Security Top 10 - 20231 control

Address API4:2023 Unrestricted Resource Consumption + API6:2023 Unrestricted Access to Sensitive Business Flows per OWASP API Security Top 10 2023.

OWASPAPI-4 · Unrestricted Resource Consumption and Sensitive Business Flows →

Questions people ask about captcha

What is CAPTCHA?
A challenge-response test used to determine whether a user is human or an automated bot. CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart.
Why is CAPTCHA important for compliance?
CAPTCHA is a key concept in Information Security. Understanding captcha helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address CAPTCHA?
CAPTCHA appears in the requirement text of WCAG 2.2, EN 301 549 - Accessibility requirements for ICT products and services, ISO 27002:2022, ITU-T X.805 - Security Architecture for End-to-End Communications, OWASP API Security Top 10 - 2023. Across these standards we have identified 6 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about CAPTCHA?
Explore our compliance framework pages to see how captcha applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how CAPTCHA applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.