- contact@verticalserve.com
- Continuous compliance, proven every hour
Frameworks & controls
One control set, every framework
SOC 2, SOC 1, ISO 27001, HIPAA, PCI DSS, NIST CSF 2.0, GDPR and ISO 42001 ship in the library: 559 requirements, each mapped to the unified controls that satisfy it. Adopt a framework and the controls you already run count toward it immediately.
The library
Eight frameworks, adopted in one click
Adopting a framework copies its requirements into your workspace and links each one to the unified controls that address it. Controls already adopted for another framework are shared, not duplicated, so readiness for the second framework starts from where the first one is.
- SOC 2: the 2017 Trust Services Criteria with 2022 points of focus, 61 criteria; Security always in scope, Availability, Confidentiality, Processing Integrity and Privacy selectable
- SOC 1: 13 control objectives as editable rows, with default CUECs and CSOCs
- ISO/IEC 27001:2022: clauses 4–10 and all 93 Annex A controls
- HIPAA Security Rule and Breach Notification, PCI DSS v4.0.1, NIST CSF 2.0 (6 functions, 22 categories, their subcategories), GDPR and ISO/IEC 42001
- Custom frameworks: your own requirements, mapped to the same controls
Requirements
Every criterion shows the controls behind it, and their state
Each requirement lists the controls mapped to it, coloured by their live health. A requirement is met when it has at least one in-scope control and all of them are passing or not applicable; in progress when some are not; a gap when nothing is mapped yet. Readiness is met requirements over in-scope requirements.
Taking a requirement out of scope needs a written reason. The SOC 2 categories you do not report on go out of scope with that reason filled in; the reason is what an auditor, or your ISO Statement of Applicability, reads.
Controls
114 controls, and why each one is in its state
A control’s health is computed, not ticked. In order: marked not applicable (with a reason); any linked monitor failing → failing; nothing linked yet → not started; a manual or hybrid control without accepted evidence inside its window, or a linked policy unpublished or overdue for review → needs evidence; otherwise passing. The control page lists the reasons.
Every control carries the statement an auditor reads, an owner, a frequency, its nature for SOC 1 and the test procedure the auditor will use.
Evidence windows
How old evidence may be before a control needs more
| Control frequency | Evidence must be collected within |
|---|---|
| Continuous, daily | 7 days |
| Weekly | 14 days |
| Monthly | 45 days |
| Quarterly | 120 days |
| Annually, or on an event | 395 days |
How it works
A requirement is met when every control behind it passes
Questions it answers
What you can find out
Each one is answered on a screen you can open, and most can be typed into Ask Assure as they are.
How ready are we for SOC 2?The framework’s readiness ring and the requirements not yet met
Which controls block ISO 27001 A.8.5?The requirement’s mapped controls with their health
What would adopting HIPAA add?The library card: requirements and controls, most already shared
Why is CHG-02 failing?The control’s reasons: the five monitors that fail
Which criteria are out of scope, and why?The out-of-scope filter with each written reason
What does the auditor test for BCP-01?The control’s test procedure and evidence guidance
Outcomes
What teams do with it
A second framework at a head start
ISO 27001 after SOC 2 begins with every shared control already proven.
Scope that survives an audit
Every exclusion carries the reason the auditor will ask for.
One owner per control
Assigned once, accountable across every framework that uses it.
Where it stops. Mappings are the library’s and are editable; they are not legal advice. NIST CSF subcategories and ISO 42001 controls are mapped to the unified set as closely as it allows, and a few requirements (for example PCI DSS 9.5 on point-of-interaction devices) have no matching control and show as gaps until you add one.