Frameworks

SOC 2 is an AICPA attestation that a service organization's controls meet the Trust Services Criteria. Security is required in every report; the other four criteria are optional, and the controls you write depend on your people, technology, and products.

The Health Insurance Portability and Accountability Act (HIPAA) sets national standards to protect individuals' medical records and personal health information. It applies to covered entities and their business associates, governing the confidentiality and integrity of protected health information (PHI).

The General Data Protection Regulation (GDPR) is an EU law that enforces strict rules on personal data protection and privacy. It regulates how organizations handle the personal information of EU and EEA residents and controls data transfers outside these areas.

ISO/IEC 27001:2022 is the international standard for information security management systems (ISMS). It gives you a systematic way to manage sensitive information and protect its confidentiality, integrity, and availability, with 93 Annex A controls in four themes.

ISO/IEC 42001:2023 is the international standard for AI management systems (AIMS). It sets out how to establish, run, and improve AI governance so your organization can show responsible, accountable use of AI.

ISO/IEC 27002:2022 is the guidance companion to ISO 27001. It explains how to implement each information security control, so you can design the practices behind your ISMS; it is not certifiable on its own.

The Payment Card Industry Data Security Standard (PCI DSS) is a global security standard for organizations handling credit card information. It sets requirements to ensure a secure environment and protect cardholder data.

The NIST Cybersecurity Framework (CSF 2.0) offers voluntary guidance from the U.S. government to help organizations manage cybersecurity risk across six functions: Govern, Identify, Protect, Detect, Respond, and Recover.

NIST SP 800-53 Revision 5 is the catalog of security and privacy controls for federal information systems, organized into 20 control families and used well beyond government.

NIST SP 800-171 outlines security requirements for safeguarding Controlled Unclassified Information (CUI) in non-federal systems.

Import any set of controls, from an industry standard to your own internal policy, and manage it alongside the built-in frameworks with the same mapping, evidence, and program tooling.