Free tool
Which compliance framework do I need?
Customers, regulators and tenders ask for different things. Answer 5 questions about who you sell to and what data you handle, and we'll show which frameworks fit, which to start with, and why.
How it works
- 1Answer 5 questions about where your customers are, who is asking you for compliance, what data you handle, whether you use AI and what kind of business you are.
- 2Each answer is checked against the requirements buyers, regulators and tenders commonly set for SOC 2, ISO 27001, HIPAA, HITRUST, the DPDP Act, GDPR, PCI DSS, SOC 1, ISO 42001, ISO 27701 and Middle East privacy laws.
- 3See which framework to start with, which others you also need, and the reason for each, with links to learn more.
Your answers stay in your browser and are never sent anywhere.
Question 1 of 50% done
Frequently asked questions
SOC 2 is an attestation report from a licensed CPA firm, mostly requested by US customers. ISO 27001 is a certificate from an accredited certification body, recognised worldwide. They share most security controls.
Yes. Most controls overlap, so a common control set lets you prepare for several frameworks with one round of work.
It's a starting point based on common buyer requirements. Always check what your customer's contract or questionnaire actually asks for.