Frameworks we support
One control set. Every framework you are asked for.
Healthcare, payments, government, EU regulation and AI. We map your controls once, then reuse the work across each framework your customers and regulators name.
Teams facing more than one framework, or a regulation that arrived with a deadline.
app.resilientprivacy.com/grc/frameworks
Simulated environment, real workflow.
Coverage
Industry, government, EU and AI frameworks.
SOC 2, ISO 27001 and privacy have their own pages. Here is everything else we prepare you for. AI frameworks link to our AI governance practice.
HIPAA
Security risk analysis, safeguards, policies and evidence for health data.
Health-tech, providers, business associates
PCI DSS v4.0
Scoping, segmentation review, gap assessment and SAQ or ROC preparation.
Merchants, payment and e-commerce platforms
NIST CSF 2.0 · 800-53 · 800-171
Gap assessment and control mapping against the NIST families.
Public sector, federal contractors
CMMC 2.0
Scoping, system security plan, POA&M and assessment preparation.
Defense industrial base suppliers
DORA
ICT risk framework, register of information, incident reporting and resilience testing.
EU financial entities, ICT providers
NIS2
Gap assessment, governance duties and the incident reporting process.
Essential and important entities
EU AI Act
Role and risk classification, technical documentation and conformity preparation. Phased obligations; dates confirmed at engagement.
AI providers and deployers
AI governance practiceNIST AI RMF
Govern, Map, Measure, Manage, with the generative AI profile (NIST AI 600-1).
Teams building or buying AI
AI governance practiceISO/IEC 42001
An AI management system that reuses your ISO 27001 structure.
Teams building or buying AI
AI governance practiceWhere AI lands in All frameworks.
AI frameworks (ISO/IEC 42001, NIST AI RMF, EU AI Act) are run by our AI governance practice on this same unified control set.
How the mapping works
From framework list to one control set that serves them all.
- 01
Applicability
Confirm which frameworks and regulations apply, and to which parts of the business.
Output: Applicability matrix
- 02
Unified control set
One set of controls mapped to every framework in scope, so each control is built once.
Output: Unified control set
- 03
Gap and plan
Gaps ranked by deadline and by how many frameworks each fix satisfies.
Output: Gap plan
- 04
Implement and evidence
Controls, policies and evidence collection shared across frameworks.
Output: Evidence library
- 05
Assess
Readiness review and coordination with the assessor, auditor or regulator for each framework.
Output: Readiness review
Deliverables
What you keep when we are done.
Documents and systems your team owns and runs, not a binder that goes stale.
- Applicability assessment by framework
- Unified control set with cross-mapping
- Gap report and sequenced roadmap
- Framework-specific documents (SSP, ROPA, ICT risk framework and more)
- Evidence library tagged by framework
- Assessment and audit coordination
Typical timeline
Varies with scopeApplicability
Weeks 1–2
Which rules apply and where.
Map and gap
Weeks 2–5
Unified controls, gap report.
Implement
Months 2–6
Sequenced by deadline and reuse.
Assess
Per framework
Readiness check and assessor coordination.
FAQ
Straight answers.
Which framework should we start with?
Usually the one a customer or regulator has asked for by name. We map it to the others so the next one reuses the work.
Does the EU AI Act apply to us?
If you place AI systems on the EU market or use them there, probably. Obligations are phased and the timetable has been under review, so we classify each system by role and risk tier and confirm the dates that apply at engagement.
Are you a CMMC assessor (C3PAO) or PCI QSA?
We prepare you and coordinate with the accredited assessor, who issues the result.
Can software keep us compliant?
It handles evidence collection and monitoring. People still own the decisions, and we help with both.
Find out how close you are to audit-ready.
A 30-minute readiness conversation with a Risk & Compliance lead, scoped to the frameworks you are asked for.