15+ frameworks. Mapped automatically.

The de facto trust standard for SaaS. Customers ask for it before they sign, auditors test it annually, and it's the gateway to selling enterprise.

• IAM access reviews and SSO logs
• Vulnerability scanner output (Nessus, Qualys, Tenable)
• Cloud configuration snapshots (AWS Config, GCP, Azure)
• Cross-mapped to ISO 27001, HIPAA, NIST CSF + 1 more

The international standard for information security management systems. Required for many enterprise deals — especially in Europe and APAC — and a strong signal of mature security operations.

• ISMS documentation and policy versions
• Statement of Applicability with control justifications
• Risk treatment plans and residual risk records
• Cross-mapped to SOC 2, HIPAA, GDPR + 1 more

The most widely adopted cybersecurity framework in the United States. Voluntary but increasingly expected by regulators, partners, and insurance carriers.

• Asset inventory with criticality ratings
• Vulnerability scan output and remediation tickets
• Identity and access management logs
• Cross-mapped to CIS Controls, ISO 27001, SOC 2 + 1 more

The federal law governing protected health information in the United States. Covered entities and business associates must implement administrative, physical, and technical safeguards — and can be fined per violation.

• Workforce training completion records
• Access reviews on systems handling PHI
• Encryption status of data at rest and in transit
• Cross-mapped to SOC 2, ISO 27001, NIST 800-66 + 1 more

The mandatory security standard for any organization that stores, processes, or transmits cardholder data. PCI DSS v4 added 64 new requirements that go fully effective in 2025.

• Network segmentation diagrams and validation tests
• Vulnerability scan output (ASV and internal)
• Penetration test reports with remediation status
• Cross-mapped to SOC 2, ISO 27001, NIST CSF

The certification framework defense contractors must meet to bid on DoD contracts. Level 2 requires third-party assessment; Level 3 requires DIBCAC assessment.

• System Security Plan (SSP) with control implementation statements
• Plan of Action and Milestones (POA&M) for any unmet controls
• CUI inventory and handling procedures
• Cross-mapped to NIST 800-171, NIST 800-172, NIST CSF

The federal government's standardized program for cloud security authorization. Required to sell cloud services to most US federal agencies.

• System Security Plan (SSP) sections aligned to NIST 800-53 Rev 5
• Continuous monitoring (ConMon) deliverables
• Vulnerability scan output (DHS-approved scanner outputs)
• Cross-mapped to NIST 800-53 Rev 5, FISMA, NIST CSF + 1 more

The European Union's data-protection regulation. Applies to any organization processing the personal data of EU residents — regardless of where the organization is based. Fines up to 4% of global annual revenue.

• Records of Processing Activities (RoPA) per Article 30
• Data Subject Access Request (DSAR) handling logs
• Lawful basis records and consent capture
• Cross-mapped to ISO 27001, ISO 27701, SOC 2 + 1 more

The IT general controls (ITGC) framework that public companies — and companies preparing to go public — must demonstrate to their external auditors annually under Sarbanes-Oxley.

• Privileged access reviews on financial systems
• Change management approvals for production deployments
• Segregation of duties matrices
• Cross-mapped to COSO, COBIT, NIST 800-53 + 1 more

The Federal Financial Institutions Examination Council's IT examination guidance. Examiners use it as the basis for IT exams of US banks, credit unions, and supervised entities.

• Cybersecurity Assessment Tool (CAT) responses with maturity progression
• Wire and ACH controls and segregation of duties
• Vendor management documentation per FIL-44-2008
• Cross-mapped to FFIEC CAT, NIST CSF, PCI DSS + 1 more

The pragmatic, prioritized cybersecurity controls developed by a global community of practitioners. Implementation Group tiers (IG1, IG2, IG3) let smaller organizations start where they are.

• Asset inventory (hardware and software)
• Vulnerability scan and patching cadence
• Account and access management logs
• Cross-mapped to NIST CSF, ISO 27001, PCI DSS + 1 more

The risk-assessment method built for the CIS Controls — it turns a safeguard list into a defensible argument about which risks are reasonable to accept and why.

• Asset and software inventory
• Vulnerability scanner output
• Safeguard implementation status from the CIS assessment
• Cross-mapped to CIS Controls v8, NIST CSF, ISO 27001

The fifteen basic safeguarding requirements from FAR 52.204-21, across six domains. The floor for any contractor handling Federal Contract Information.

• IAM access reviews and account inventory
• Endpoint inventory and patch status
• Boundary protection and firewall configuration
• Cross-mapped to CMMC Level 2, NIST SP 800-171, NIST CSF

Twenty-four enhanced requirements drawn from NIST SP 800-172, across ten domains — the tier for contractors on the programmes most likely to be targeted by advanced persistent threats.

• Privileged access and session monitoring
• Threat-hunting and detection coverage records
• Configuration baselines and drift reports
• Cross-mapped to CMMC Level 2, NIST SP 800-171, NIST SP 800-172

The Cloud Security Alliance's structured controls catalog for AI systems — covering data, model, governance, and deployment dimensions. The most prescriptive AI controls framework available.

• Training data classification and provenance
• Model evaluation and red-team results
• Prompt-injection and jailbreak testing logs
• Cross-mapped to NIST AI RMF, ISO 42001, SOC 2 + 1 more

Build the assessment your programme actually needs — your questions, your scoring, your evidence requirements — and get the same dashboard, trend and remediation workflow every published framework gets.

• Any evidence type available to a built-in framework
• Scheduled collection from connected systems
• Uploaded artifacts with freshness tracking
• Cross-mapped to Any published framework in Talarity

The cloud half of an FFIEC examination. Forty-five questions on the risks examiners actually raise about cloud: who is responsible for what, how configuration drift is caught, and what happens if you have to leave.

• Cloud configuration snapshots (AWS Config, GCP, Azure Policy)
• IAM role and privileged-access reviews
• Cloud logging and detection coverage reports
• Cross-mapped to NIST CSF, FFIEC IT Handbook, ISO 27001 + 1 more

Thirty-nine requirements across eight domains — governance, risk assessment, safeguards, testing, personnel, service providers, incident response and reporting. The FTC rule that turned information security from good practice into a written obligation with a named accountable person.

• IAM access reviews and account inventory
• Encryption status for data at rest and in transit
• Vulnerability scanner and penetration test output
• Cross-mapped to NIST CSF, ISO 27001, SOC 2 + 1 more

The first certifiable management-system standard for artificial intelligence — the AI equivalent of what ISO 27001 is for information security, with 38 Annex A controls.

• AI system inventory and classification
• Model documentation and version records
• Data provenance and quality records
• Cross-mapped to NIST AI RMF, ISO 27001, EU AI Act readiness

The voluntary framework for AI risk management — covering governance, risk identification, mitigation, and continuous evaluation. Increasingly cited by regulators and required by enterprise AI buyers.

• Model cards and system cards
• Training data lineage and provenance records
• Bias testing and fairness evaluation results
• Cross-mapped to CSA AI CM, ISO 42001, EU AI Act + 1 more

Forty-two tasks across four practice groups — prepare the organisation, protect the software, produce well-secured software, respond to vulnerabilities. The framework federal software attestations point at.

• Build pipeline and provenance records
• SBOM and dependency inventory
• SAST / DAST / SCA scan output
• Cross-mapped to OWASP SAMM, ISO 27001, SOC 2 + 1 more

The NIST guide for conducting risk assessments. The reference methodology for nearly every regulatory and audit context that asks for a 'documented risk assessment.'

• Threat sources catalog with capability ratings
• Vulnerability inventory with severity
• Likelihood × impact assessments per asset
• Cross-mapped to NIST CSF, ISO 27001, HIPAA + 1 more

The Software Assurance Maturity Model: ninety activities across five business functions, measuring how software security is actually practised rather than which tools are owned.

• SAST / DAST / SCA scan output
• Secure design and threat-model records
• Training completion records
• Cross-mapped to NIST SSDF, ISO 27001, SOC 2

The SEC's cybersecurity disclosure rule requires public companies to disclose material cybersecurity incidents on Form 8-K within four business days, and to describe their cybersecurity risk management and governance in 10-K filings.

• Materiality assessments for cybersecurity incidents
• Incident timeline reconstruction with forensic linkage
• Form 8-K Item 1.05 disclosure drafts
• Cross-mapped to NIST CSF, ISO 27001, SOX

Forty-two practices across seven domains — from governance and threat modelling through to dependency security, testing and incident response — scored as a maturity ladder rather than a checklist.

• SAST / DAST / SCA scan output
• Dependency and SBOM inventory
• Code review and branch-protection settings
• Cross-mapped to OWASP SAMM, NIST SSDF, ISO 27001 + 1 more

A 122-question technology diligence across eight domains, scored 1-5 against written maturity anchors and gated on supporting artifacts — so a diligence answer is only as strong as the evidence attached to it.

• Cloud and infrastructure inventory
• Vulnerability scanner output
• SDLC and change-management records
• Cross-mapped to NIST CSF, ISO 27001, SOC 2