Value Aligners
Log in

Frameworks

Supported Compliance Frameworks and What Value Aligners Does for Each

Last updated

This page lists the compliance frameworks the Value Aligners platform supports today and what the platform does for each one: assessment, control mapping, evidence and reporting.

Support is not the same for every framework. Every framework below has a self-assessment. Six also have the GRC readiness report, and some have an evidence checklist. The table shows which.

The platform's assessments and reports are guidance to help you prioritize. They are not an audit, and they do not certify your organization against any framework.

  • SOC 2

    Trust Services Criteria from the AICPA. Self-assessment, GRC readiness report, evidence checklist, and a SOC 2 questionnaire file in board exports.

  • ISO/IEC 27001

    Information security management system standard from ISO. Self-assessment, GRC readiness report and evidence checklist.

  • NIST Cybersecurity Framework (CSF)

    Cybersecurity framework from the U.S. National Institute of Standards and Technology. Self-assessment and GRC readiness report.

  • HIPAA

    U.S. health information rules overseen by HHS. Self-assessment, GRC readiness report against the HIPAA Security Rule, and evidence checklist.

  • PCI DSS

    Payment card data standard from the PCI Security Standards Council. Self-assessment, GRC readiness report and evidence checklist.

  • GDPR

    EU data protection regulation. Self-assessment and GRC readiness report.

  • CMMC

    U.S. Department of Defense program for defense contractors. Self-assessment and evidence checklist. CMMC is not yet available in the GRC readiness report.

  • Basel III

    Banking framework from the Basel Committee on Banking Supervision. Self-assessment.

  • CCPA

    California Consumer Privacy Act. Self-assessment.

  • CIS Controls

    Prioritized security practices from the Center for Internet Security. Self-assessment.

  • COBIT

    IT governance framework from ISACA. Self-assessment.

  • Essential Eight

    Mitigation strategies from the Australian Cyber Security Centre. Self-assessment.

  • FDA cybersecurity

    Cybersecurity expectations from the U.S. Food and Drug Administration. Self-assessment.

  • FERPA

    U.S. student education records law. Self-assessment.

  • FISMA

    U.S. federal information security law. Self-assessment.

  • GLBA and DORA

    Financial services rules. One self-assessment covers GLBA and DORA questions.

  • HITRUST

    Framework from the HITRUST Alliance. Self-assessment.

  • ISA/IEC 62443

    Industrial automation and control system security standards. Self-assessment.

  • NERC CIP

    Critical infrastructure protection standards for the North American power grid. Self-assessment.

  • NYDFS Part 500

    New York Department of Financial Services cybersecurity regulation. Self-assessment.

  • OWASP Top Ten

    Web application security risks from OWASP. Self-assessment.

  • StateRAMP Texas

    Cloud security requirements for vendors to Texas state agencies. Self-assessment.

  • PASS K-12 Safety Guidelines

    School physical security guidelines (7th edition). Covered by the physical security assessment.

  • Florida SB 7026

    Florida school safety law, applied to K-12 facilities. Covered by the physical security assessment.

  • CISA K-12 School Safety

    School safety guidance from CISA. Covered by the physical security assessment.

  • NIST SP 800-82

    Operational technology security guide from NIST. Covered by the physical security assessment.

Side-by-side comparison

Supported Compliance Frameworks and What Value Aligners Does for Each: comparison
OptionAssessmentControl mappingEvidenceReporting
SOC 2Short and long self-assessment; GRC questionnaireControl families mapped in the GRC reportDocument upload in GRC; evidence checklistAssessment report; GRC readiness report; SOC 2 questionnaire export
ISO/IEC 27001Short and long self-assessment; GRC questionnaireControl families mapped in the GRC reportDocument upload in GRC; evidence checklistAssessment report; GRC readiness report
NIST Cybersecurity Framework (CSF)Short and long self-assessment; GRC questionnaireControl families mapped in the GRC reportDocument upload in GRCAssessment report; GRC readiness report
HIPAAShort and long self-assessment; GRC questionnaireControl families mapped in the GRC reportDocument upload in GRC; evidence checklistAssessment report; GRC readiness report
PCI DSSShort and long self-assessment; GRC questionnaireControl families mapped in the GRC reportDocument upload in GRC; evidence checklistAssessment report; GRC readiness report
GDPRShort and long self-assessment; GRC questionnaireControl families mapped in the GRC reportDocument upload in GRCAssessment report; GRC readiness report
CMMCShort and long self-assessmentQuestions grouped by control requirementEvidence checklistAssessment report
Basel IIIShort and long self-assessmentQuestions grouped by control requirementSelf-attested answersAssessment report
CCPAShort and long self-assessmentQuestions grouped by control requirementSelf-attested answersAssessment report
CIS ControlsShort and long self-assessmentQuestions grouped by control requirementSelf-attested answersAssessment report
COBITShort and long self-assessmentQuestions grouped by control requirementSelf-attested answersAssessment report
Essential EightShort and long self-assessmentQuestions grouped by control requirementSelf-attested answersAssessment report
FDA cybersecurityShort and long self-assessmentQuestions grouped by control requirementSelf-attested answersAssessment report
FERPAShort and long self-assessmentQuestions grouped by control requirementSelf-attested answersAssessment report
FISMAShort and long self-assessmentQuestions grouped by control requirementSelf-attested answersAssessment report
GLBA and DORAShort and long self-assessmentQuestions grouped by control requirementSelf-attested answersAssessment report
HITRUSTShort and long self-assessmentQuestions grouped by control requirementSelf-attested answersAssessment report
ISA/IEC 62443Short and long self-assessmentQuestions grouped by control requirementSelf-attested answersAssessment report
NERC CIPShort and long self-assessmentQuestions grouped by control requirementSelf-attested answersAssessment report
NYDFS Part 500Short and long self-assessmentQuestions grouped by control requirementSelf-attested answersAssessment report
OWASP Top TenShort and long self-assessmentQuestions grouped by control requirementSelf-attested answersAssessment report
StateRAMP TexasShort and long self-assessmentQuestions grouped by control requirementSelf-attested answersAssessment report
PASS K-12 Safety GuidelinesPhysical security assessmentEach control linked to assessment questionsAssessment answersControl coverage and open controls
Florida SB 7026Physical security assessmentEach control linked to assessment questionsAssessment answersControl coverage and open controls
CISA K-12 School SafetyPhysical security assessmentEach control linked to assessment questionsAssessment answersControl coverage and open controls
NIST SP 800-82Physical security assessmentEach control linked to assessment questionsAssessment answersControl coverage and open controls

The self-assessment

Every framework on this page has a self-assessment with a short and a long version. Each question is answered on a five-step scale from None to Full and carries a likelihood and impact rating.

The assessment page groups frameworks as compulsory, recommended or optional from your industry profile, so you can start with the ones that apply to you.

The report has a Summary tab and a Compliance Matrix tab. The matrix lists each control requirement the assessment asked about with its urgency, and the summary can point you to matching solution categories in the marketplace.

The GRC readiness report

For SOC 2, ISO/IEC 27001, NIST CSF, HIPAA, PCI DSS and GDPR, the GRC module builds a readiness report across a common set of control families, each mapped to a control in every framework you select.

It reads what your onboarding and Virtual CISO data already show and asks only about the rest. You can upload existing documents (PDF, Word or Excel), and the platform identifies which control families each one evidences.

The report gives a readiness score per framework, framework coverage, control gaps, an evidence matrix, a risk register and a remediation roadmap. The scores are computed by fixed rules from your answers and documents, so the same inputs give the same result; AI writes only the executive summary, and a rule-based summary is used if AI is unavailable.

Evidence checklist and exports

For SOC 2, ISO/IEC 27001, HIPAA, PCI DSS and CMMC, an evidence checklist lists the evidence each listed control needs and marks the items that your completed compliance tasks already cover.

Where your plan includes board exports, assessment results can be exported as an executive PDF, a SOC 2 questionnaire file or a machine-readable control mapping file.

Frequently asked questions

Does completing an assessment make my organization compliant?

No. The assessments and reports show where you stand and what to fix first. They are guidance, not an audit, and they do not certify your organization against any framework.

Which frameworks have the GRC readiness report?

SOC 2, ISO/IEC 27001, NIST CSF, HIPAA, PCI DSS and GDPR. Every other framework on this page has the self-assessment.

Is CMMC supported?

Yes, with a self-assessment and an evidence checklist. CMMC is not yet available in the GRC readiness report.

Can I use documents I already have as evidence?

Yes, in the GRC module. Upload PDF, Word or Excel files and the platform identifies which control families each document evidences.

Which framework should I start with?

The assessment page groups frameworks as compulsory, recommended or optional based on your industry profile. Start with the compulsory ones.

Change log

  1. Published.

    Why: Published for plan action S3.1 (framework coverage).

  2. Created the page from the frameworks supported in the product code.

    Why: To give buyers one place that lists each supported framework and what the platform does for it.