Frameworks
Compliance frameworks, mapped to one set of controls
Each framework comes with control mappings, evidence templates and audit workflows. The catalogue runs from SOC 2 and ISO 27001 to regional regulations in the Gulf and Asia-Pacific, and all of them sit on one control set: map a control once and each framework you add reuses the mapping.
How it works
Each framework arrives as a complete control set with suggested evidence types, policy templates and audit steps. When you enable a new framework, Certifyi maps its controls to the ones you already meet under other frameworks. A control that meets both SOC 2 CC6.1 and ISO 27001 A.8.2 is managed once and reported to both.
Framework catalogue
Frameworks with a detailed guide on this site. Two are guides only, as marked. Ask us for the full catalogue.
- SOC 2
- Trust Services Criteria for security, availability, processing integrity, confidentiality and privacy.
- ISO 42001
- Management system standard for responsible AI development and deployment.
- ISO 27701
- Privacy information management system standard for PII controllers and processors.
- GDPR
- EU regulation governing the processing and protection of personal data.
- HIPAA
- US regulation protecting the privacy and security of health information.
- PCI DSS
- Payment card industry standard for organisations that handle cardholder data.
- CMMC
- Cybersecurity maturity model for US defence contractors.
- Cyber Essentials
- UK government-backed scheme for baseline cybersecurity controls.
- EU AI Act
- EU regulation classifying AI systems by risk and setting obligations for each tier.
- HITRUST CSF
- Common security framework widely adopted in healthcare and financial services.
- NIST AI RMF
- US framework for managing risks associated with AI systems across their lifecycle.
- DORA
- EU regulation on digital operational resilience for financial entities.
- NIS 2
- EU directive on network and information security for essential and important entities.
- ISO 22301
- International standard for business continuity management systems.
- CIS Controls
- Prioritised cyber defence safeguards in three Implementation Groups, from essential hygiene up.
- NIST CSF 2.0
- Voluntary US framework of six functions for managing cybersecurity risk, now with Govern.
- SAMA CSF
- Saudi Central Bank cyber security framework for banks, insurers and other member organisations.
- UAE IA Standard
- UAE information assurance controls for government and designated critical entities.
- MAS TRM
- Monetary Authority of Singapore guidelines and notices on technology risk.
- APRA CPS 234
- Binding Australian prudential standard on information security for APRA-regulated entities.
- Essential Eight
- Australian Signals Directorate mitigation strategies, assessed across four maturity levels.
- NCA ECC
- Saudi baseline cybersecurity controls for government and critical national infrastructure. Guide only: ECC is not in the published catalogue.
- RBI cyber security
- Reserve Bank of India requirements for banks and regulated entities, from the 2016 framework to the 2026 Directions.
- Bangladesh Bank
- Bangladesh Bank's 2026 Cybersecurity Framework and ICT Security Guideline for banks, finance companies and payment providers. Guide only: not in the published catalogue.
- FTC Safeguards Rule
- GLBA security program for non-bank lenders, brokers, dealers, tax preparers and other FTC-regulated firms.
- NYDFS Part 500
- New York cybersecurity regulation for banks, insurers and other DFS-regulated entities.
- India DPDP Act
- Indian data protection law. Guide only, as DPDP is not in the catalogue, though Certifyi supports its notices and consent records.
Multi-framework
Run several frameworks without duplicate work
Most organisations need more than one framework. SOC 2 and ISO 27001 overlap heavily in their technical controls, though ISO 27001’s management-system clauses have no SOC 2 equivalent. GDPR privacy requirements overlap with both. Certifyi maps these overlaps, so a control that serves several frameworks is managed once.
- Map once. A control is mapped once and the mapping is reused across frameworks.
- Shared controls. One owner and one body of evidence for a control that several frameworks need, with the result reported to each of them.
- Gap analysis. When you add a framework, see which of its controls need new evidence or new processes.
Custom frameworks
Build your own control frameworks
Beyond the catalogue, you can create custom frameworks for internal policies, customer requirements or industry codes of conduct. A custom framework is versioned in your workspace and runs through the same projects, evidence and reporting. It is not mapped to the catalogue frameworks, so evidence is linked to its controls directly.
- Internal policies. Turn company policies into auditable controls with evidence requirements.
- Customer requirements. Track a customer’s security requirements as a framework of their own.
- Industry codes. Model an industry code of conduct as a control set.
- New regulations. Map a regulation’s requirements before a formal framework exists.
Recommended modules
Frameworks are run through these modules, where the controls, evidence, policies and risks behind them are kept.
Questions
Framework questions
How long does it take to add a new framework?
Adopting a framework from the catalogue is quick, because its controls are mapped to the ones you already run. The real work is the gap analysis: working out which new controls need new evidence or new processes. How long that takes depends on your programme.
Can I run SOC 2 and ISO 27001 together?
Yes. The two overlap heavily in their technical controls. Certifyi maps the shared controls, so you manage one set of controls and report against both standards. ISO 27001’s management-system clauses still need their own work.
Are custom frameworks supported?
Yes. You can create custom frameworks for internal policies, customer requirements or industry codes, and each is versioned in your workspace. Custom frameworks are not mapped to the catalogue, so cross-framework evidence reuse applies to catalogue frameworks only.
How many frameworks can I run at once?
There is no technical limit. Growth plans include up to five frameworks, and Enterprise plans have no limit. Because controls are shared, each framework you add usually needs less new work than the first.
See your frameworks mapped to one set of controls
Book a demo and list the frameworks and regulators you answer to, global and regional. You will see how they sit on one control set and where they overlap.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them