Frameworks we cover

Enterprise buyers assess you against a small number of recognised standards. SOC 2 is the one they ask for most, and the programme we run most. Where two frameworks overlap, one control set and one evidence base serves both.

SOC 2, and the standards run alongside it

SOC 2 leads this list because it is what enterprise buyers ask for and where most of our work sits. We run the readiness assessment, implement the controls, draft the policies, prepare the evidence, manage the programme and coordinate the independent CPA firm that performs the examination. We do not perform the examination and we do not issue the report.

• SOC 2 →
  Readiness, implementation, project management and audit preparation for Type I and Type II engagements. The report most enterprise security reviews begin with, examined by an independent CPA firm against the Trust Services Criteria. This is the programme we run most.
• ISO 27001 →
  The international standard for information security management, certified by an accredited certification body. Commonly run alongside SOC 2 because the underlying control set and evidence largely overlap.
• ISO/IEC 42001 →
  The international standard for an AI management system, and the one now appearing in enterprise procurement. Certifiable.

Regulations and frameworks

• EU AI Act →
  The European regulation governing AI by risk category, with obligations phasing in over several years.
• NIST AI RMF →
  A voluntary framework from the United States, frequently referenced by American buyers and useful as an operating method.
• GDPR for AI →
  Where data protection obligations and AI governance overlap, including impact assessments and automated decision-making.
• DORA →
  The European regulation on digital operational resilience for financial entities and their critical ICT providers, covering ICT risk management, incident reporting and third-party oversight.