SOC 2
- Who needs it
- US software and service companies selling to businesses.
- What we check
- The Trust Services Criteria: security, plus availability, confidentiality, processing integrity and privacy if you include them.
Standards Readiness
Twelve standards. One way to prove them.
The same readiness check, evidence fingerprints and signed report for every standard. Pick only the standards you need, and your first assessment is free.
01
Security & trust
The frameworks customers and auditors ask for first.
ISO/IEC 27001:2022
- Who needs it
- Any organization proving it runs an information security management system, worldwide.
- What we check
- Clauses 4 to 10 of the management system and the Annex A controls.
PCI DSS v4.0.1
- Who needs it
- Anyone who stores, processes or transmits payment card data.
- What we check
- The 12 principal requirements, including the ones that became mandatory on 31 March 2025.
NIST CSF 2.0
- Who needs it
- Organizations of any size wanting a common security baseline.
- What we check
- The six functions: Govern, Identify, Protect, Detect, Respond and Recover.
02
Privacy
Personal data laws in the EU, UK and California.
GDPR
- Who needs it
- Anyone processing personal data of people in the EU or UK.
- What we check
- Lawful basis, notices, individuals' rights, security, breaches, processors and transfers.
CCPA / CPRA
- Who needs it
- Businesses above the California thresholds that handle Californians' data.
- What we check
- Notices, the rights to know, delete, correct and opt out, Global Privacy Control, contracts and security.
03
Regulated sectors
Defense contractors, essential services and financial firms.
CMMC 2.0 Level 2 / NIST SP 800-171
- Who needs it
- US Defense contractors and subcontractors that handle Controlled Unclassified Information.
- What we check
- The System Security Plan, SPRS score, POA&M and the most-failed of the 110 requirements.
NIS2
- Who needs it
- Essential and important entities in EU sectors such as energy, health, digital infrastructure and ICT services.
- What we check
- Management accountability, the ten risk-management measures of Article 21, and the 24-hour, 72-hour and one-month reporting steps.
DORA
- Who needs it
- EU financial entities and the ICT providers that serve them.
- What we check
- ICT risk management, incident classification and reporting, resilience testing and third-party risk.
04
AI governance
How you manage, test and disclose AI.
ISO/IEC 42001:2023
- Who needs it
- Organizations building or using AI that want a certifiable AI management system.
- What we check
- The AI management system clauses and the Annex A controls for AI.
EU AI Act, Article 50
- Who needs it
- Providers and deployers of chatbots, generated content and deepfakes offered in the EU.
- What we check
- The transparency duties: telling people they are talking to AI and marking AI-generated content.
NIST AI RMF
- Who needs it
- Anyone who wants to show buyers and regulators they manage AI risk with care.
- What we check
- The Govern, Map, Measure and Manage functions, plus the Generative AI Profile.
Every standard
All 12 standards in one workspace
Every check, every signed report. Pay per standard or take them all; the plans are on the pricing page. HIPAA has its own tool, the HIPAA readiness tool.
Readiness checks, not certifications. Only a licensed CPA firm can issue a SOC 2 report, only an accredited body can certify ISO 27001 or ISO 42001, and only an authorized assessor can grant CMMC certification. Why a readiness check still matters.