Frameworks
SOC 2 is the spine, and ISO 27001, HIPAA and GDPR are Criteria mapped onto the same Controls, so a new framework adds rows and no new work.
A framework is a set of Criteria, and each Control declares the Criteria it satisfies. One Control answers several frameworks at once, so adding a framework adds rows, not machinery.
One Control, many Criteria
Log completeness proves that no record is missing from the log. That one test satisfies SOC 2 CC7.2, ISO 27001 A.8.15 and HIPAA 164.312(b).
The crosswalk is an edge on the Control, not a second program. When the test passes, it passes for every framework that cites it.
| Framework | Criteria | Applies when |
|---|---|---|
| SOC 2 | Security, availability, confidentiality, processing integrity and privacy | Always |
| ISO 27001 | Information security controls | Always |
| HIPAA | The security rule and breach notification | A field holds patient data for a provider, plan or clearinghouse |
| GDPR | Lawful basis, data subject rights, records of processing, breach notice | A Startup processes personal data of people in the EU or UK |
Criteria lists every row and the Controls behind it.
SOC 2 is the spine
Every Control satisfies at least one SOC 2 criterion. Every SOC 2 criterion in scope is satisfied by a Control or marked as floor.
The other frameworks map onto the same Controls. ISO 27001 adds no Controls of its own: its statement of applicability renders from each Control's resolution and its latest Proof.
What HIPAA and GDPR add
HIPAA wakes when a field holds patient data. The business associate agreement is an Agreement, signed before the first record is stored, and Health data agreements tests that order.
GDPR's records of processing render from each field's data class and the Purposes that read it. A request to erase becomes a Suppression plus a read restriction: the record stays sealed in the log, and nothing reads it again. Your data explains erasure in full.
Carved out
Some criteria are met by the upstreams the platform runs on. Physical access to data centers, under SOC 2 CC6.4 and CC6.5 and HIPAA 164.310(a)(1), is carved out to the infrastructure upstreams.
Their own reports are on file under Upstream review, each with an expiry date that opens a Task before it lapses. Card data never touches the platform, so PCI DSS is carved out to Stripe.
Each report lists its carve-outs, generated from the upstreams the platform called during the period. Subprocessors names them.