Frameworks & Regulations

Different requirements. One program of controls and evidence.

We do not treat each standard as a separate universe.Where requirements overlap, we reuse controls, risks and evidence without confusing legal or audit obligations.

SOC 2 Type 1

ISO 27001

ISO 42001

CCPA

GDPR

ISO 27701

HIPAA

FERPA

CASA

SOC 2

Vezi platforma GRC Managed Compliance

Assurance & certification

Two assurance paths, two different types of outcome.

SOC2 and ISO/IEC 27001 can reuse a significant portion of controls and evidence, but auditor engagement and final outcome are not the same.

SOC 2

Controls and evidence for an assurance report.

Scope, Trust Services Criteria, Type I/II, evidence lifecycle and audit readiness.

ISO/IEC 27001

Risk Management and Continual Improvement.

Scope, clauses 4 to 10, Annex A, Statement of Applicability, internal audit and certification readiness.

Regulatory & privacy

The framework does not change the technical reality of the organization.

GDPR, NIS2 and accessibility require different contexts, but all require processes that can be operated and demonstrated — not just documents created for review.

GDPR & Privacy

Data mapping, RoPA, DPIA, TIA, rights requests, third parties and technical measures related to the privacy program.

NIS2

Governance, cyber risk, incident readiness, supply chain security and resilience for organizations in scope.

Accessibility

Assessment, remediation and ongoing management of digital accessibility as part of the compliance program.

Cross-framework

You reuse work without pretending that standards are equivalent.

The same access review, risk treatment, or evidence can support multiple requirements when mapping is justified.

How the platform works

Don’t see the framework you need?

We can evaluate the requirement and mapping before adding a new program to the scope.

Talk to ZBTKEEP