Frameworks
Do the work once. Count it toward every framework.
Wardline's library of 81 common controls is mapped to six frameworks. Pick one to see its control families, then compare it with a second to see what you'd already have done.
Framework explorer
SOC 2 (Trust Services Criteria)
The report most US buyers ask for. Type I looks at control design on one date; Type II tests how controls operated over an observation period of usually 3 to 12 months.
- Who issues it
- An attestation report issued by a licensed CPA firm after its own audit.
- Typical prep
- 6–12 weeks to prepare, then the observation period and audit fieldwork for Type II.
- Wardline controls
- 61 across 15 control families
Controls by family
Mapped controls out of the family's total in the library.
- Access control9/9
- Asset management5/6
- Business continuity4/4
- Change management5/5
- Cryptography3/4
- Data privacy2/9
- Governance and policies3/6
- People security4/5
- Incident response4/4
- Logging and monitoring4/6
- Network security3/4
- Physical security2/3
- Risk management4/4
- Vendor management3/5
- Vulnerability management6/7
Cross-mapping
57 of SOC 2's 61 controls (93%) also count toward ISO 27001. Adding ISO 27001 after SOC 2 means 6 new controls, not 63.
| ID | Control | |
|---|---|---|
| AC-01 | Unique user accounts for every personAccess control | SOC 2ISO 27001HIPAAPCI DSSNIST CSF |
| AC-02 | Multi-factor authentication on workforce accountsAccess control | SOC 2ISO 27001HIPAAPCI DSSNIST CSF |
| AC-03 | Single sign-on for production and admin toolsAccess control | SOC 2ISO 27001NIST CSF |
| AC-04 | Role-based access with least privilegeAccess control | SOC 2ISO 27001HIPAAGDPRPCI DSSNIST CSF |
| AC-05 | Quarterly user access reviewsAccess control | SOC 2ISO 27001HIPAAPCI DSSNIST CSF |
| AC-06 | Access removed within one business day of departureAccess control | SOC 2ISO 27001HIPAAPCI DSSNIST CSF |
| AC-07 | Privileged access approved and time-limitedAccess control | SOC 2ISO 27001PCI DSSNIST CSF |
| AC-08 | Password and passphrase standardAccess control | SOC 2ISO 27001HIPAAPCI DSS |
| AC-09 | Shared and service accounts inventoriedAccess control | SOC 2ISO 27001PCI DSSNIST CSF |
| AM-01 | Inventory of hardware and cloud assetsAsset management | SOC 2ISO 27001HIPAAPCI DSSNIST CSF |
| AM-02 | Data classification schemeAsset management | SOC 2ISO 27001GDPRNIST CSF |
| AM-04 | Acceptable use policy acknowledgedAsset management | SOC 2ISO 27001HIPAA |
| AM-05 | Media and device disposalAsset management | SOC 2ISO 27001HIPAAPCI DSS |
| AM-06 | Owners assigned for critical assetsAsset management | SOC 2ISO 27001NIST CSF |
| BC-01 | Business continuity planBusiness continuity | SOC 2ISO 27001HIPAANIST CSF |
| BC-02 | Encrypted backups with restore testsBusiness continuity | SOC 2ISO 27001HIPAAPCI DSSNIST CSF |
| BC-03 | Disaster recovery test each yearBusiness continuity | SOC 2ISO 27001HIPAANIST CSF |
| BC-04 | Recovery time and point objectivesBusiness continuity | SOC 2ISO 27001NIST CSF |
| CM-01 | Peer review before production changesChange management | SOC 2ISO 27001PCI DSSNIST CSF |
| CM-02 | Separate development, test and productionChange management | SOC 2ISO 27001PCI DSS |
| CM-03 | Infrastructure changes tracked in codeChange management | SOC 2ISO 27001NIST CSF |
| CM-04 | Emergency change procedureChange management | SOC 2ISO 27001PCI DSS |
| CM-05 | Secure development lifecycleChange management | SOC 2ISO 27001PCI DSSNIST CSF |
| CR-01 | Data encrypted at restCryptography | SOC 2ISO 27001HIPAAGDPRPCI DSSNIST CSF |
| CR-02 | Data encrypted in transit (TLS 1.2 or later)Cryptography | SOC 2ISO 27001HIPAAGDPRPCI DSSNIST CSF |
| CR-03 | Key management and rotationCryptography | SOC 2ISO 27001PCI DSSNIST CSF |
| DP-05 | Retention schedule and secure deletionData privacy | SOC 2ISO 27001HIPAAGDPRPCI DSS |
| GV-01 | Information security policy approved yearlyGovernance and policies | SOC 2ISO 27001HIPAAPCI DSSNIST CSF |
| GV-02 | Security roles and responsibilities assignedGovernance and policies | SOC 2ISO 27001HIPAAPCI DSSNIST CSF |
| GV-03 | Leadership oversight of the security programGovernance and policies | SOC 2ISO 27001NIST CSF |
| HR-01 | Background checks where lawfulPeople security | SOC 2ISO 27001PCI DSS |
| HR-02 | Security awareness training at hire and yearlyPeople security | SOC 2ISO 27001HIPAAPCI DSSNIST CSF |
| HR-03 | Confidentiality agreements signedPeople security | SOC 2ISO 27001HIPAA |
| HR-04 | Disciplinary process for policy violationsPeople security | SOC 2ISO 27001HIPAA |
| IR-01 | Incident response planIncident response | SOC 2ISO 27001HIPAAGDPRPCI DSSNIST CSF |
| IR-02 | Incident response exercise each yearIncident response | SOC 2ISO 27001HIPAAPCI DSSNIST CSF |
| IR-03 | Security incidents logged and reviewedIncident response | SOC 2ISO 27001HIPAAPCI DSSNIST CSF |
| IR-04 | Lessons learned after major incidentsIncident response | SOC 2ISO 27001NIST CSF |
| LM-01 | Centralized audit loggingLogging and monitoring | SOC 2ISO 27001HIPAAPCI DSSNIST CSF |
| LM-02 | Alerts on suspicious activityLogging and monitoring | SOC 2ISO 27001PCI DSSNIST CSF |
| LM-03 | Log retention for at least twelve monthsLogging and monitoring | SOC 2ISO 27001HIPAAPCI DSS |
| NS-01 | Firewall and security group rules reviewedNetwork security | SOC 2ISO 27001PCI DSSNIST CSF |
| NS-02 | Network segmentation of productionNetwork security | SOC 2ISO 27001PCI DSS |
| NS-04 | Remote access over encrypted channelsNetwork security | SOC 2ISO 27001HIPAAPCI DSS |
| PS-01 | Data center physical security (inherited from the cloud provider)Physical security | SOC 2ISO 27001HIPAAPCI DSS |
| PS-02 | Office badge access and visitor logPhysical security | SOC 2ISO 27001PCI DSS |
| RM-01 | Annual risk assessmentRisk management | SOC 2ISO 27001HIPAAPCI DSSNIST CSF |
| RM-02 | Risk register with owners and treatmentsRisk management | SOC 2ISO 27001NIST CSF |
| RM-04 | Security objectives set by leadershipRisk management | SOC 2ISO 27001NIST CSF |
| VD-01 | Vendor inventory with risk tiersVendor management | SOC 2ISO 27001GDPRNIST CSF |
| VD-02 | Security review before onboarding a vendorVendor management | SOC 2ISO 27001HIPAAGDPRPCI DSSNIST CSF |
| VD-03 | Yearly review of critical vendorsVendor management | SOC 2ISO 27001PCI DSSNIST CSF |
| VL-01 | Vulnerability scanning of infrastructureVulnerability management | SOC 2ISO 27001PCI DSSNIST CSF |
| VL-02 | Annual penetration test by an independent firmVulnerability management | SOC 2ISO 27001PCI DSS |
| VL-03 | Patch timelines by severityVulnerability management | SOC 2ISO 27001HIPAAPCI DSSNIST CSF |
| VL-04 | Endpoint protection on company devicesVulnerability management | SOC 2ISO 27001HIPAAPCI DSSNIST CSF |
| VL-05 | Disk encryption on laptopsVulnerability management | SOC 2ISO 27001HIPAANIST CSF |
Overlap at a glance
Shared controls between every pair
Each cell counts the Wardline controls that serve both frameworks. The diagonal is each framework's total. Select a number to compare that pair.
Plain answers
Who gives you what, and for how long
Wardline gets you ready and keeps you ready. It never issues a report or certificate, and a vendor that says it does is worth a second look.
| Framework | What you get | From | Renewal |
|---|---|---|---|
| SOC 2 | Type I or Type II attestation report | A licensed CPA firm | Usually every 12 months |
| ISO 27001 | Certificate | An accredited certification body | 3 years, surveillance audits yearly |
| HIPAA | Risk analysis and documented safeguards | You, often with an independent assessor | Review at least yearly |
| GDPR | Records that show compliance | You; supervisory authorities enforce | Ongoing |
| PCI DSS | Report on Compliance or Self-Assessment Questionnaire | A Qualified Security Assessor, or you | Every 12 months |
| NIST CSF | Current and target profiles | You, or an outside reviewer | Voluntary |
General information, not legal advice. Your auditor and counsel decide what applies to you.
Not sure which framework your buyers need?
The readiness assessment suggests a timeline for any of them.