Any framework. Your anchor.

Pick the framework your program is organized around. Everything else maps to it, requirement by requirement, and partial coverage is shown as partial.

Pick the framework that is blocking you

You already run this in a spreadsheet, a SOC 2 automation tool, or an enterprise GRC suite
The next customer or regulator wants a second framework and you cannot reuse the work
You need dated, cited coverage, including partials, not a green dashboard

Security & privacy

FrameworksSOC 2

AICPA Trust Services Criteria: Type I and Type II readiness.

→FrameworksISO 27001

ISO/IEC 27001:2022 ISMS and the 93 Annex A controls.

→FrameworksNIST CSF 2.0

Govern, Identify, Protect, Detect, Respond, Recover, with maturity scoring.

→FrameworksCIS Controls

18 prioritized safeguards with implementation groups.

→FrameworksGDPR

EU data protection: records, DPIAs, processors, and breaches.

→FrameworksPCI DSS 4.0

The 12 requirements for protecting cardholder data.

→

Government & defense

FrameworksNIST SP 800-53

The federal control catalog behind FISMA and FedRAMP.

→FrameworksNIST SP 800-171

Protecting Controlled Unclassified Information in nonfederal systems.

→FrameworksCMMC 2.0

Levels 1–3 for the defense industrial base.

→

Sector & regional

FrameworksHIPAA

Security Rule risk analysis for covered entities and business associates.

→FrameworksHITRUST

The certifiable framework common in healthcare.

→FrameworksDORA

EU digital operational resilience for financial entities.

→FrameworksNIS2

EU cybersecurity obligations for essential and important entities.

→FrameworksSOX ITGC

IT general controls for financial reporting.

→

AI governance

FrameworksNIST AI RMF

Govern, Map, Measure, Manage for AI risk.

→FrameworksISO/IEC 42001

The certifiable AI management system standard.

→

Harmonized & custom

FrameworksSCF & UCF

Harmonized control frameworks, shipped as packs.

→FrameworksCustom frameworks

Bring your own internal standard; TruOps maps it.

→

Questions

Which compliance frameworks does TruOps support?

Any. Out of the box: SOC 2, ISO 27001, NIST CSF 2.0, NIST SP 800-53, NIST SP 800-171, CMMC 2.0, HIPAA, PCI DSS, HITRUST, DORA, NIS2, NIST AI RMF, ISO/IEC 42001, GDPR, SOX ITGC, CIS Controls, SCF, and UCF, plus any framework or internal standard you upload.

Do I have to use SCF?

No. You choose the anchor framework; SCF and UCF are optional packs.

Can I switch from another GRC or SOC 2 tool?

Yes. Upload the reports, workbooks, and exports you already have. TruOps sets up the program from them for you to review. Connectors to your cloud, identity, and code tools are read-only.

See it run on your own data.

Thirty minutes with a GRC expert, not an SDR. Bring one real document (a SOC 2 report, a risk register, a vendor list; redacted is fine) and watch TruOps set up a live program from it, with an assessment already pre-filled.