One control answer. Four overlapping audits.
Most controls in SOC 2, ISO 27001, HIPAA, and PCI overlap. ThirdSentry maps them once, so a single piece of evidence satisfies every framework that requires it. Designed to cut audit prep by up to ~40% (an illustrative built-to-deliver target).
Stop answering the same question four times.
Cross-framework control mapping
Pre-built mappings between SOC 2, ISO 27001, HIPAA, NIST, PCI, NYDFS. Add a control once and see exactly which framework requirements it satisfies, and which still need work.
- Pre-seeded cross-framework mappings
- Coverage gaps surfaced automatically
- Auto-link evidence to mapped controls
Evidence reused, not rewritten
When you upload a pen test report or SOC 2 evidence, the platform auto-links it to every control across every framework that requires that evidence type. No duplicate uploads.
- One evidence artifact, multiple controls
- Auto-link by control taxonomy
- Tenant-scoped vector retrieval
Per-framework audit views
Auditors get framework-specific views with only the controls and evidence relevant to that framework. AUDITOR role is read-only at the data layer, so they can't accidentally edit your records.
- AUDITOR view per framework
- Read-only enforced at data layer
- Immutable PolicyVersion on publish
Frequently asked questions
How does cross-framework control mapping work?
Controls in the ten built-in frameworks are mapped to each other. Each mapping has a type, such as equivalent or partial overlap. When two controls are mapped as equivalent, work done on one counts toward the other. You see which requirements in a second framework are already covered and which still need their own evidence.
Does passing a control in one framework automatically pass it in another?
Only where the two controls are mapped as equivalent. A verdict is inherited across equivalent controls and never across partial overlaps or loosely related controls. That keeps a broad control in one framework from marking a narrower requirement in another as verified when it was not, which is the result an auditor would challenge.
Which frameworks can we run together in ThirdSentry?
Ten frameworks are seeded in the platform: SOC 2, ISO 27001:2022, NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8.1, PCI DSS v4.0.1, the HIPAA Security Rule, GDPR, NYDFS 23 NYCRR Part 500, and NYSDOH 10 NYCRR 405.46. Their controls arrive already cross-mapped, so you do not build the mapping yourself before a second audit.
Is control testing automated for every framework?
No. Connector-based automated control testing currently covers SOC 2 and NIST 800-53, where data from an integration is scored to a pass or fail verdict. For the other frameworks, evidence is collected and linked to controls, and assessments are scored with reviewer validation. A reviewer can override any automated result.
What does it cost to add another framework?
Price depends on the frameworks you run, not on users. Every tier is a flat fee with unlimited users and AI features included, so the bill does not grow with headcount. The four tiers are Launch, Foundation, Professional, and Enterprise. A demo is the place to scope the framework mix for your audits.