# Frameworks

URL: /systems/trust-and-governance/frameworks · Id: `page:systems/trust-and-governance/frameworks`

> SOC 2 is the spine, and ISO 27001, HIPAA and GDPR are Criteria mapped onto the same Controls, so a new framework adds rows and no new work.

A framework is a set of [Criteria](/business/nouns/criterion), and each [Control](/business/nouns/control) declares the Criteria it satisfies. One Control answers several frameworks at once, so adding a framework adds rows, not machinery.

## One Control, many Criteria
[Log completeness](/systems/trust-and-governance/controls/log-completeness) proves that no record is missing from the log. That one test satisfies SOC 2 CC7.2, ISO 27001 A.8.15 and HIPAA 164.312(b).

The crosswalk is an edge on the Control, not a second program. When the test passes, it passes for every framework that cites it.

| Framework | Criteria | Applies when |
| --- | --- | --- |
| SOC 2 | Security, availability, confidentiality, processing integrity and privacy | Always |
| ISO 27001 | Information security controls | Always |
| HIPAA | The security rule and breach notification | A field holds patient data for a provider, plan or clearinghouse |
| GDPR | Lawful basis, data subject rights, records of processing, breach notice | A [Startup](/business/nouns/startup) processes personal data of people in the EU or UK |

[Criteria](/systems/trust-and-governance/criteria) lists every row and the Controls behind it.

## SOC 2 is the spine
Every Control satisfies at least one SOC 2 criterion. Every SOC 2 criterion in scope is satisfied by a Control or marked as floor.

The other frameworks map onto the same Controls. ISO 27001 adds no Controls of its own: its statement of applicability renders from each Control's resolution and its latest [Proof](/business/nouns/proof).

## What HIPAA and GDPR add
HIPAA wakes when a field holds patient data. The business associate agreement is an [Agreement](/business/nouns/agreement), signed before the first record is stored, and [Health data agreements](/systems/trust-and-governance/controls/health-data-agreements) tests that order.

GDPR's records of processing render from each field's data class and the [Purposes](/business/nouns/purpose) that read it. A request to erase becomes a [Suppression](/business/nouns/suppression) plus a read restriction: the record stays sealed in the log, and nothing reads it again. [Your data](/systems/trust-and-governance/your-data) explains erasure in full.

## Carved out
Some criteria are met by the upstreams the platform runs on. Physical access to data centers, under SOC 2 CC6.4 and CC6.5 and HIPAA 164.310(a)(1), is carved out to the infrastructure upstreams.

Their own reports are on file under [Upstream review](/systems/trust-and-governance/controls/upstream-review), each with an expiry date that opens a [Task](/business/nouns/task) before it lapses. [Card](/business/nouns/card) data never touches the platform, so PCI DSS is carved out to Stripe.

Each report lists its carve-outs, generated from the upstreams the platform called during the period. [Subprocessors](/systems/trust-and-governance/subprocessors) names them.

## Next
- [Criteria](/systems/trust-and-governance/criteria): every framework row.
- [Controls](/systems/trust-and-governance/controls): every Control, its test and its Criteria.