Standards, frameworks & regulations

Connect ISO 27001 requirements, controls, risks, evidence, owners, and remediation in one continuously managed compliance program.

Put the NIST Cybersecurity Framework (CSF) 2.0 into practice with Essential Compliance. Connect cybersecurity outcomes to controls, evidence, accountable owners and risk-based action plans.

Manage your SOC 2 program with Essential Compliance. Connect Trust Services Criteria to accountable owners, shared controls, recurring evidence, and remediation, while keeping the related business risks in view.

Manage AI policies, risks, controls, evidence, impact assessments, and improvement work against ISO 42001.

Organize regulatory obligations by AI system and regulatory role, map them to controls and evidence, track applicable requirements, surface gaps, and coordinate accountable remediation.

Connect AI governance and compliance activities with the Govern, Map, Measure, and Manage approach to AI risk management.

Map existing ISO 27001 and cybersecurity controls to applicable NIS2 obligations, including country-specific requirements, reuse existing evidence and focus remediation on the gaps that actually remain.

Map DORA digital operational resilience obligations to existing ICT risk, incident, testing and third-party controls, then reuse evidence across NIS2 and related cybersecurity programs.

Manage overlapping requirements across B-13, B-10, E-21 and other OSFI guidelines through a common set of controls, risks, evidence and actions.

Manage AML/ATF obligations under the PCMLTFA and associated regulations, linking requirements to policies, controls, risks, evidence, training and accountable owners.

Manage IT risk, operational resilience and related FSRA requirements for Ontario-regulated financial services through connected controls, risks, evidence and actions.

Manage dealer compliance obligations across CIRO rules, linking requirements to policies, controls, evidence, risks and accountable owners.

Connect operational risk, incident, safeguarding, reporting, and evidence obligations to the people and controls responsible for them.

Manage operational resilience requirements across important business services, impact tolerances, mapping, testing, vulnerabilities, incidents and remediation.

Manage outsourcing and third-party risk requirements, linking suppliers to risks, controls, evidence, due diligence, monitoring and exit plans.

Manage Consumer Duty requirements and evidence across products and services, price and value, consumer understanding and consumer support.

Manage GDPR obligations across privacy governance, data protection, individual rights, security, breach response and accountability, with connected controls, risks and evidence.

Manage Canadian privacy obligations across accountability, consent, safeguards, access, breach management and evidence of compliance.

Manage UK data protection requirements across privacy governance, individual rights, security, breach response, accountability and supporting evidence.

Manage Quebec privacy requirements across governance, privacy impact assessments, consent, individual rights, incidents and accountability.

Manage information security requirements across risk assessments, safeguards, access controls, service providers, monitoring, incidents and accountable owners.

Manage cybersecurity requirements across governance, risk assessments, controls, third parties, incident response, reporting and evidence.

Manage operational resilience requirements across critical business services, impact tolerances, mapping, testing, third-party dependencies and remediation.

Manage consumer protection requirements across governance, products and services, customer communications, support, vulnerable customers and evidence of compliance.

Manage accountability requirements across senior management responsibilities, conduct standards, certification, fitness and probity, and supporting evidence.

Manage CMMC requirements and supporting evidence across security controls, assessments, remediation activities and accountable owners.

Manage HIPAA security requirements across risk analysis, safeguards, policies, access controls, incident response and evidence of compliance.

Manage payment security requirements across controls, assessments, evidence, remediation and ongoing compliance activities.