Can one control satisfy multiple frameworks?

Yes. Compyl maps each control and its evidence across every framework it satisfies. For example, evidence of enforced MFA can satisfy SOC 2 CC6.1, ISO 27001 A.8.5, PCI DSS 8.4, and NIST 800-53 IA-2 at once. You collect the evidence one time and it satisfies every framework that requires it.

How fast can I add a new framework?

Because your evidence is already mapped to a single control library, adding the next framework mostly reuses controls and evidence you already have. Compyl shows your coverage instantly and only the net-new requirements need attention, which is what makes the second and third framework far faster and more efficient to achieve than the first.

Frameworks

Every framework.
One control library.

Q: How many compliance frameworks does Compyl support?

Compyl supports 70+ frameworks out of the box, including SOC 2, ISO 27001, ISO 42001, HIPAA, GDPR, CCPA, PCI DSS, NIST CSF, NIST SP 800-53, MAS, and NIS2, plus custom frameworks you define. One control library is cross-mapped to all of them, so evidence collected for one framework is automatically reused everywhere it applies.

Q: Can I add a custom or industry-specific framework?

Yes. Beyond the prebuilt catalog, Compyl lets you define custom frameworks and internal control sets, then cross-map them to your existing controls and evidence so they stay continuously monitored alongside everything else.

Q: How does Compyl keep framework evidence audit-ready?

Compyl connects to your stack and collects evidence automatically, then continuously scores every artifact on relevance, freshness, and completeness with Evidence Health. Control gaps and drift surface weeks before an audit instead of during it, so each framework stays in a live, audit-ready state.

Compyl cross-maps a single control library to 70+ compliance frameworks, regulations, and standards. Collect your evidence once, satisfy every framework it applies to, and keep them all continuously audit-ready, instead of running a separate project for each.

Request a Demo → See the platform

Interactive · try it

See it for yourself

Tap a piece of evidence Compyl pulls automatically from your stack, and watch one item satisfy controls across multiple frameworks at once.

↳ this one item satisfies controls across frameworks

The catalog

The most common frameworks we automate

These are the frameworks most teams start with, each running on the same connected evidence and continuous monitoring. The full library of 70+ is just below.

SOC 2

The trust standard for B2B SaaS, Type I & Type II, all five Trust Services Criteria.

Explore SOC 2 → ISO
27001

ISO 27001

Run a certifiable ISMS continuously and collect Annex A evidence automatically.

Explore ISO 27001 → ISO
42001

ISO 42001

Govern your AI management system (AIMS) and evidence responsible-AI controls continuously.

See it mapped → HIPAA

HIPAA

Safeguard PHI across the Security, Privacy, and Breach Notification rules.

Explore HIPAA → PCI
DSS

PCI DSS

Protect cardholder data and stay continuously aligned to PCI DSS v4.

Explore PCI DSS → NIST
CSF

NIST CSF

Manage cybersecurity risk across Govern, Identify, Protect, Detect, Respond, Recover.

Explore NIST CSF → NIST
800-53

NIST SP 800-53

Implement and monitor the federal control catalog across all control families.

Explore 800-53 → GDPR

GDPR

Operationalize EU data-privacy obligations and evidence them on demand.

Explore GDPR →

Collect once · satisfy many

One piece of evidence. Every framework it satisfies.

Compyl maps each control and its evidence across every framework that requires it. So a single artifact, pulled automatically from your stack, counts everywhere at once.

One control library mapped to all 70+ frameworks, no duplicate work per framework.
Add the next framework in a fraction of the time, most of it is already covered by evidence you have.
Evidence Health scores every artifact on relevance, freshness, and completeness, so it stays audit-ready.

MFA enforced on all users

pulled automatically from your identity provider

↳ ONE EVIDENCE ITEM SATISFIES 4 CONTROLS

CC6.1 SOC 2 A.8.5 ISO 27001 8.4 PCI DSS IA-2 NIST 800-53

The full library

70+ frameworks, regulations & standards, and growing

From SOC 2 to the EU AI Act, every framework runs on the same connected evidence. Filter the full library below, or request a demo to see yours mapped to your stack.

ACSC Essential Eight – Maturity Level 1Framework ACSC Essential Eight – Maturity Level 2Framework ACSC Essential Eight – Maturity Level 3Framework APRA CPS 234Regulation Assured AI Framework (AAIF)Framework AWS Foundational Technical Review (FTR)Attestation BSI Cloud Computing Compliance Criteria Catalogue (C5)Attestation CCPARegulation CIS AWS Foundations BenchmarkStandard CIS v8Framework CJIS Security PolicyRegulation Cloud Security Alliance Cloud Controls Matrix (CCM) 4.0.1Framework CMMC 2.0 Level 1Attestation CMMC 2.0 Level 2Attestation CMS ARS 5.0Standard CMS MARS-E v2.2Standard COBIT 2019Framework CPRARegulation CSA Code of Conduct for GDPRFramework CSA STARAttestation Cyber Risk Institute (CRI) ProfileFramework Cybersecurity Capability Maturity Model (C2M2)Guidance Digital Services Act (DSA)Regulation DORARegulation ETSI EN 319 401Standard EU AI ActRegulation FedRAMP 20xFramework FedRAMP High BaselineFramework FedRAMP Low BaselineFramework FedRAMP Moderate BaselineFramework FFIEC Cybersecurity Assessment ToolFramework FIPARegulation GDPRRegulation GLBARegulation GLBA Safeguards RuleRegulation HIPAARegulation ISO 9001Certification Standard ISO/IEC 22301Certification Standard ISO/IEC 27001:2013Certification Standard ISO/IEC 27001:2022Certification Standard ISO/IEC 27017:2015Standard ISO/IEC 27018Standard ISO/IEC 27031:2011Standard ISO/IEC 27032Guidance ISO/IEC 27701Certification Standard ISO/IEC 42001:2023Certification Standard LGPDRegulation Microsoft Supplier Privacy & Security Assurance (SSPA / DPR)Standard Minimum Viable Secure Product (MVSP)Guidance MITRE ATT&CKGuidance MITRE D3FENDGuidance NCSC Cyber Assessment Framework (CAF)Framework NERCRegulation NIS2 DirectiveRegulation NIST AI Risk Management FrameworkFramework NIST CSF 2.0Framework NIST Privacy FrameworkFramework NIST Secure Software Development Framework (SSDF)Guidance NIST SP 800-171Standard NIST SP 800-53Standard NIST SP 800-66 Rev.2Guidance NISTIR 8374Guidance NYDFS Cybersecurity Regulation (23 NYCRR Part 500)Regulation OFDSS (Open Finance Data Security Standard)Framework OSFI B-13Regulation PCI DSS 4.0Standard PCI DSS SAQ AAttestation PCI DSS SAQ A-EPAttestation SEC Regulation S-PRegulation Secure Controls Framework (SCF)Framework SOC 2Attestation SOX ITGCRegulation SWIFT Customer Security Controls FrameworkFramework TISAXAttestation UK Cyber EssentialsAttestation USDPFramework WCAG 2.2Standard

Why Compyl

Built to make every framework take less time than the last

One source of truth

Controls, evidence, and mappings live in one place, connected across governance, risk, and compliance.

Continuous, not point-in-time

Evidence refreshes automatically and is scored for health, so frameworks stay audit-ready year-round.

Agentic AI does the busywork

AI drafts evidence blueprints and maps controls across frameworks, your experts approve what matters.

Frameworks FAQ

Questions about framework coverage

70+ frameworks out of the box, including SOC 2, ISO 27001, ISO 42001, HIPAA, GDPR, CCPA, PCI DSS, NIST CSF, NIST SP 800-53, MAS, and NIS2, plus custom frameworks you define. One control library is cross-mapped to all of them.

Yes. Compyl maps each control and its evidence across every framework it satisfies. Evidence of enforced MFA, for example, can satisfy SOC 2 CC6.1, ISO 27001 A.8.5, PCI DSS 8.4, and NIST 800-53 IA-2 at once, collected one time.

Because your evidence is mapped to a single control library, adding the next framework mostly reuses what you already have. Compyl shows coverage instantly, so only the net-new requirements need attention, making the second and third framework far faster and more efficient than the first.

Yes. Beyond the prebuilt catalog, you can define custom frameworks and internal control sets, then cross-map them to your existing controls and evidence so they stay continuously monitored alongside everything else.

Compyl collects evidence automatically and continuously scores every artifact on relevance, freshness, and completeness with Evidence Health. Gaps and drift surface weeks before an audit, so each framework stays in a live, audit-ready state.

GRC Your Way

See your frameworks, cross-mapped to your stack

One platform for the whole GRC lifecycle, with agentic AI that removes the busywork and leaves your experts in control.

Request a Demo →

Every framework.One control library.