Every framework your auditor asks for.
The major frameworks shipped out of the box. Cross-framework control mapping reduces evidence collection across overlapping audits. Plus custom frameworks for sector-specific requirements.
SOC 2
Trust Services Criteria
All five Trust Services Criteria for service organization controls.
Learn moreISO 27001
Information Security 2022
Global information security management standard.
Learn moreNIST CSF
Cybersecurity Framework 2.0
Identify, Protect, Detect, Respond, Recover.
Learn moreNIST 800-53
Rev 5 · 298 controls
Federal-grade security and privacy controls catalog.
Learn moreCIS v8.1
Critical Security Controls
Prioritized defense-in-depth control set.
Learn morePCI DSS
v4.0.1 · Payment card data
Payment Card Industry Data Security Standard.
Learn moreHIPAA
Security Rule · PHI
Protected Health Information safeguards.
Learn moreGDPR
EU personal data protection
General Data Protection Regulation compliance.
Learn moreNYDFS Part 500
23 NYCRR · NY financial
New York financial services cybersecurity.
Learn moreNYSDOH 405.46
10 NYCRR · NY hospital
New York hospital cybersecurity requirements.
Learn moreCustom frameworks
Bring your own controls and evidence requirements, including internal frameworks, sector-specific (FFIEC, NERC CIP), regional regulations.
Talk to usFrequently asked questions
Which compliance frameworks does ThirdSentry support?
ThirdSentry ships with ten frameworks: SOC 2 Trust Services Criteria, ISO 27001:2022, NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8.1, PCI DSS v4.0.1, the HIPAA Security Rule, GDPR, NYDFS 23 NYCRR Part 500, and NYSDOH 10 NYCRR 405.46. Each one is seeded with its controls, so you start from a populated library.
If we already have SOC 2, how much carries over to ISO 27001 or another framework?
Controls are cross-mapped between frameworks. Where a control in your current framework is mapped as equivalent to one in the new framework, its verdict is inherited, so that work is not repeated. Partial overlaps do not inherit a verdict. You see what is covered and what still needs evidence in the new framework.
Does ThirdSentry cover New York frameworks like NYDFS Part 500?
Yes. NYDFS 23 NYCRR Part 500 and NYSDOH 10 NYCRR 405.46 are both built in, alongside HIPAA, PCI DSS, SOC 2, and the NIST catalogs. Their controls are cross-mapped to the other frameworks, so a team answering to a New York regulator and a SOC 2 auditor works from one control library.
Is automated control testing available for every framework?
No. Connector-based automated control testing currently covers SOC 2 and NIST 800-53. In those frameworks, data from an integration is scored against a defined test and returns a pass or fail verdict. All ten frameworks support assessments, evidence linking, and cross-mapping, and a reviewer's decision always overrides an automated result.
Do we pay per framework?
Yes, the price scales with the frameworks you run. Every tier is a flat fee with unlimited users, and AI features are included on all four tiers: Launch, Foundation, Professional, and Enterprise. You are not charged per seat, so auditors, control owners, and reviewers can all be added. Talk to us to scope the frameworks you need.
Cross-framework mapping, included.
One control answer satisfies SOC 2 + ISO 27001 + HIPAA + PCI overlapping requirements. Reduce evidence collection by 40%+.