Frameworks
Do the work once. Count it toward every framework.
Wardline's library of 81 common controls is mapped to six frameworks. Pick one to see its control families, then compare it with a second to see what you'd already have done.
Framework explorer
SOC 2 (Trust Services Criteria)
The report most US buyers ask for. Type I looks at control design on one date; Type II tests how controls operated over an observation period of usually 3 to 12 months.
- Who issues it
- An attestation report issued by a licensed CPA firm after its own audit.
- Typical prep
- 6–12 weeks to prepare, then the observation period and audit fieldwork for Type II.
- Wardline controls
- 61 across 15 control families
Controls by family
Mapped controls out of the family's total in the library.
- Access control 9/9
- Asset management 5/6
- Business continuity 4/4
- Change management 5/5
- Cryptography 3/4
- Data privacy 2/9
- Governance and policies 3/6
- People security 4/5
- Incident response 4/4
- Logging and monitoring 4/6
- Network security 3/4
- Physical security 2/3
- Risk management 4/4
- Vendor management 3/5
- Vulnerability management 6/7
Cross-mapping
57 of SOC 2's 61 controls (93%) also count toward ISO 27001. Adding ISO 27001 after SOC 2 means 6 new controls, not 63.
| ID | Control | |
|---|---|---|
| AC-01 | Unique user accounts for every personAccess control | SOC 2 ISO 27001 HIPAA PCI DSS NIST CSF |
| AC-02 | Multi-factor authentication on workforce accountsAccess control | SOC 2 ISO 27001 HIPAA PCI DSS NIST CSF |
| AC-03 | Single sign-on for production and admin toolsAccess control | SOC 2 ISO 27001 NIST CSF |
| AC-04 | Role-based access with least privilegeAccess control | SOC 2 ISO 27001 HIPAA GDPR PCI DSS NIST CSF |
| AC-05 | Quarterly user access reviewsAccess control | SOC 2 ISO 27001 HIPAA PCI DSS NIST CSF |
| AC-06 | Access removed within one business day of departureAccess control | SOC 2 ISO 27001 HIPAA PCI DSS NIST CSF |
| AC-07 | Privileged access approved and time-limitedAccess control | SOC 2 ISO 27001 PCI DSS NIST CSF |
| AC-08 | Password and passphrase standardAccess control | SOC 2 ISO 27001 HIPAA PCI DSS |
| AC-09 | Shared and service accounts inventoriedAccess control | SOC 2 ISO 27001 PCI DSS NIST CSF |
| AM-01 | Inventory of hardware and cloud assetsAsset management | SOC 2 ISO 27001 HIPAA PCI DSS NIST CSF |
| AM-02 | Data classification schemeAsset management | SOC 2 ISO 27001 GDPR NIST CSF |
| AM-04 | Acceptable use policy acknowledgedAsset management | SOC 2 ISO 27001 HIPAA |
| AM-05 | Media and device disposalAsset management | SOC 2 ISO 27001 HIPAA PCI DSS |
| AM-06 | Owners assigned for critical assetsAsset management | SOC 2 ISO 27001 NIST CSF |
| BC-01 | Business continuity planBusiness continuity | SOC 2 ISO 27001 HIPAA NIST CSF |
| BC-02 | Encrypted backups with restore testsBusiness continuity | SOC 2 ISO 27001 HIPAA PCI DSS NIST CSF |
| BC-03 | Disaster recovery test each yearBusiness continuity | SOC 2 ISO 27001 HIPAA NIST CSF |
| BC-04 | Recovery time and point objectivesBusiness continuity | SOC 2 ISO 27001 NIST CSF |
| CM-01 | Peer review before production changesChange management | SOC 2 ISO 27001 PCI DSS NIST CSF |
| CM-02 | Separate development, test and productionChange management | SOC 2 ISO 27001 PCI DSS |
| CM-03 | Infrastructure changes tracked in codeChange management | SOC 2 ISO 27001 NIST CSF |
| CM-04 | Emergency change procedureChange management | SOC 2 ISO 27001 PCI DSS |
| CM-05 | Secure development lifecycleChange management | SOC 2 ISO 27001 PCI DSS NIST CSF |
| CR-01 | Data encrypted at restCryptography | SOC 2 ISO 27001 HIPAA GDPR PCI DSS NIST CSF |
| CR-02 | Data encrypted in transit (TLS 1.2 or later)Cryptography | SOC 2 ISO 27001 HIPAA GDPR PCI DSS NIST CSF |
| CR-03 | Key management and rotationCryptography | SOC 2 ISO 27001 PCI DSS NIST CSF |
| DP-05 | Retention schedule and secure deletionData privacy | SOC 2 ISO 27001 HIPAA GDPR PCI DSS |
| GV-01 | Information security policy approved yearlyGovernance and policies | SOC 2 ISO 27001 HIPAA PCI DSS NIST CSF |
| GV-02 | Security roles and responsibilities assignedGovernance and policies | SOC 2 ISO 27001 HIPAA PCI DSS NIST CSF |
| GV-03 | Leadership oversight of the security programGovernance and policies | SOC 2 ISO 27001 NIST CSF |
| HR-01 | Background checks where lawfulPeople security | SOC 2 ISO 27001 PCI DSS |
| HR-02 | Security awareness training at hire and yearlyPeople security | SOC 2 ISO 27001 HIPAA PCI DSS NIST CSF |
| HR-03 | Confidentiality agreements signedPeople security | SOC 2 ISO 27001 HIPAA |
| HR-04 | Disciplinary process for policy violationsPeople security | SOC 2 ISO 27001 HIPAA |
| IR-01 | Incident response planIncident response | SOC 2 ISO 27001 HIPAA GDPR PCI DSS NIST CSF |
| IR-02 | Incident response exercise each yearIncident response | SOC 2 ISO 27001 HIPAA PCI DSS NIST CSF |
| IR-03 | Security incidents logged and reviewedIncident response | SOC 2 ISO 27001 HIPAA PCI DSS NIST CSF |
| IR-04 | Lessons learned after major incidentsIncident response | SOC 2 ISO 27001 NIST CSF |
| LM-01 | Centralized audit loggingLogging and monitoring | SOC 2 ISO 27001 HIPAA PCI DSS NIST CSF |
| LM-02 | Alerts on suspicious activityLogging and monitoring | SOC 2 ISO 27001 PCI DSS NIST CSF |
| LM-03 | Log retention for at least twelve monthsLogging and monitoring | SOC 2 ISO 27001 HIPAA PCI DSS |
| NS-01 | Firewall and security group rules reviewedNetwork security | SOC 2 ISO 27001 PCI DSS NIST CSF |
| NS-02 | Network segmentation of productionNetwork security | SOC 2 ISO 27001 PCI DSS |
| NS-04 | Remote access over encrypted channelsNetwork security | SOC 2 ISO 27001 HIPAA PCI DSS |
| PS-01 | Data center physical security (inherited from the cloud provider)Physical security | SOC 2 ISO 27001 HIPAA PCI DSS |
| PS-02 | Office badge access and visitor logPhysical security | SOC 2 ISO 27001 PCI DSS |
| RM-01 | Annual risk assessmentRisk management | SOC 2 ISO 27001 HIPAA PCI DSS NIST CSF |
| RM-02 | Risk register with owners and treatmentsRisk management | SOC 2 ISO 27001 NIST CSF |
| RM-04 | Security objectives set by leadershipRisk management | SOC 2 ISO 27001 NIST CSF |
| VD-01 | Vendor inventory with risk tiersVendor management | SOC 2 ISO 27001 GDPR NIST CSF |
| VD-02 | Security review before onboarding a vendorVendor management | SOC 2 ISO 27001 HIPAA GDPR PCI DSS NIST CSF |
| VD-03 | Yearly review of critical vendorsVendor management | SOC 2 ISO 27001 PCI DSS NIST CSF |
| VL-01 | Vulnerability scanning of infrastructureVulnerability management | SOC 2 ISO 27001 PCI DSS NIST CSF |
| VL-02 | Annual penetration test by an independent firmVulnerability management | SOC 2 ISO 27001 PCI DSS |
| VL-03 | Patch timelines by severityVulnerability management | SOC 2 ISO 27001 HIPAA PCI DSS NIST CSF |
| VL-04 | Endpoint protection on company devicesVulnerability management | SOC 2 ISO 27001 HIPAA PCI DSS NIST CSF |
| VL-05 | Disk encryption on laptopsVulnerability management | SOC 2 ISO 27001 HIPAA NIST CSF |
Overlap at a glance
Shared controls between every pair
Each cell counts the Wardline controls that serve both frameworks. The diagonal is each framework's total. Select a number to compare that pair.
Plain answers
Who gives you what, and for how long
Wardline gets you ready and keeps you ready. It never issues a report or certificate, and a vendor that says it does is worth a second look.
| Framework | What you get | From | Renewal |
|---|---|---|---|
| SOC 2 | Type I or Type II attestation report | A licensed CPA firm | Usually every 12 months |
| ISO 27001 | Certificate | An accredited certification body | 3 years, surveillance audits yearly |
| HIPAA | Risk analysis and documented safeguards | You, often with an independent assessor | Review at least yearly |
| GDPR | Records that show compliance | You; supervisory authorities enforce | Ongoing |
| PCI DSS | Report on Compliance or Self-Assessment Questionnaire | A Qualified Security Assessor, or you | Every 12 months |
| NIST CSF | Current and target profiles | You, or an outside reviewer | Voluntary |
General information, not legal advice. Your auditor and counsel decide what applies to you.
Not sure which framework your buyers need?
The readiness assessment suggests a timeline for any of them.