Frameworks

Map once. Prove across many.

We build one unified control set and connect it to every framework you answer to. Evidence you collect once supports audits, assessments, and customer reviews across the board.

Frameworks we work with

Standards, regulations, and sector requirements.

NIST

  • —NIST Cybersecurity Framework (CSF) 2.0
  • —NIST SP 800-30 (risk assessment)
  • —NIST SP 800-37 (Risk Management Framework)
  • —NIST SP 800-53 (security and privacy controls)
  • —NIST SP 800-171 and CMMC (protecting controlled unclassified information)
  • —NIST SP 800-161 (cybersecurity supply chain risk management)
  • —NIST SP 800-34 (contingency planning and disaster recovery)
  • —NIST SP 800-66 (HIPAA Security Rule implementation)
  • —NIST AI Risk Management Framework

ISO

  • —ISO/IEC 27001 (information security management)
  • —ISO/IEC 27005 (information security risk)
  • —ISO/IEC 42001 (AI management systems)
  • —ISO 22301 (business continuity management)

Privacy and data protection

  • —GDPR (European Union)
  • —CCPA/CPRA (California)
  • —PIPL (China's Personal Information Protection Law)
  • —U.S. DOJ Data Security Rule (28 C.F.R. Part 202)

Financial services and operational resilience

  • —SOX (U.S. Sarbanes-Oxley IT controls)
  • —J-SOX (Japan)
  • —DORA (EU Digital Operational Resilience Act)
  • —NIS2 Directive (EU)

Industry and sector

  • —PCI DSS v4.0.1
  • —HIPAA and HITRUST
  • —SOC 2
  • —FDA 21 C.F.R. Part 11

Trustalis provides advisory, readiness, and assessment services and works alongside your auditor or assessor of choice. Certifications and attestations are issued by accredited bodies: PCI DSS Reports on Compliance by PCI SSC-approved QSA companies, and CMMC certification assessments by authorized C3PAOs.

Cross-framework mapping

One control set, many obligations.

01

Inventory obligations

Identify which frameworks, regulations, and customer requirements actually apply, and where they overlap.

02

Map controls once

Build a single control set with clear owners, mapped to each applicable requirement.

03

Reuse the evidence

Collect evidence once and reference it across audits, assessments, and customer reviews.

Working toward a specific framework?

Tell us which requirements apply and your target date. We will show you the shortest sound path there.

Talk to a practitioner