Compliance Frameworks
Explore the requirements, evidence and review questions for six frameworks. Start with the one relevant to your scope, then use related-control links to compare overlapping topics.
ISO 27001
ISO/IEC 27001:2022 - Information Security Management Systems
ISO 27001 sets requirements for an information security management system. Define its scope, assess risks and select appropriate controls. This library explains the 93 Annex A controls; certification also covers the management system requirements in clauses 4 to 10.
93
Reference guides
Preparation depends on scope and existing practices
Planning the review
NIS2
NIS2 Directive (EU) 2022/2555
NIS2 sets cybersecurity and incident-reporting requirements for entities within its scope, implemented through national law. This library groups the directive into review topics. Confirm your entity's scope and national requirements before using the checklist.
46
Reference guides
Check the law and deadlines in your jurisdiction
Planning the review
SOC 2
SOC 2 - Trust Services Criteria
A SOC 2 report provides independent assurance over controls for a defined service system. A CPA firm examines the relevant Trust Services Criteria. Use these guides to prepare evidence and discuss scope; the library entries are not a substitute for the AICPA criteria or the auditor's assessment.
59
Reference guides
Agree the report type and period with your CPA firm
Planning the review
GDPR
General Data Protection Regulation (EU) 2016/679
GDPR governs personal-data processing within its scope. Start with your processing activities and controller or processor role, then review lawful basis, rights, security and transfers. These guides cover selected obligations; a completed checklist does not establish compliance for every activity.
50
Reference guides
Review by processing activity and risk
Planning the review
Tech Due Diligence
Technical Due Diligence
Technical due diligence asks whether the technology and team can support the business plan and what could change the investment decision. Our 40 review topics cover code, architecture, security, team and operations. Adapt them to the transaction; there is no universal Tech DD control set.
40
Reference guides
Agree access, scope and delivery dates for the engagement
Planning the review
EU Sanctions DD
EU Sanctions Due Diligence
Review the parties, ownership, goods, route and purpose of a transaction, and record the evidence behind your decision. These 25 topics help structure due diligence. Check current official lists and applicable restrictions at the time of review; this is not a live screening service or legal clearance.
25
Reference guides
Resolve material questions before proceeding
Planning the review
Cross-framework control mapping
Related-control links help you find requirements that may use similar evidence. Review scope and dates before reusing it. A mapping does not establish equivalence, and answers are not automatically copied between assessments.
Compare frameworks →Start your compliance assessment
Pick any framework and start assessing. All 6 frameworks are included on every plan, including Free.
Start free assessmentFree plan · No credit card required