Compliance
Compliance readiness and gap assessments
We find the gaps between where you are and what the framework requires, close them with you, and get you ready for the auditor.
At a glance
CyberAccord prepares organizations for security and privacy frameworks including SOC 2, ISO 27001, HIPAA, PCI DSS, NIST CSF and SP 800-171, GDPR and CCPA, NYDFS Part 500, the FTC Safeguards Rule and the EU AI Act. We run the gap assessment, build the remediation plan and documentation, and support you through the independent audit.
Frameworks
Frameworks we prepare you for
Security frameworks
Control frameworks customers, auditors and contracts ask for.
- SOC 2 Readiness and RenewalSOC 2SOC 2 readiness and renewal: gap assessment, controls, policies and evidence, prepared for your independent CPA firm's audit.
- ISO/IEC 27001:2022ISO 27001ISO/IEC 27001:2022 readiness: ISMS design, risk assessment, Annex A controls and preparation for an accredited certification audit.
- PCI DSS v4.0.1PCI DSSPCI DSS v4.0.1 readiness: cardholder data scoping, control gap analysis, SAQ support and preparation for a Qualified Security Assessor.
- NIST Gap AssessmentsNISTNIST gap assessments against CSF 2.0, SP 800-171 and SP 800-53, with scored findings and a prioritized remediation plan.
Privacy and sector rules
Laws and regulations tied to the data you hold or the sector you work in.
- HIPAA Security RuleHIPAAHIPAA Security Rule compliance: risk analysis, gap assessment, security policies and remediation planning for covered entities and business associates.
- GDPR, CCPA/CPRA and DPIAsData PrivacyData privacy compliance for GDPR and CCPA/CPRA, including data mapping, gap assessment, security controls and Data Protection Impact Assessments.
- NYDFS 23 NYCRR Part 500NYDFS 500NYDFS 23 NYCRR Part 500 compliance: risk assessment, policies, CISO support, incident response and annual compliance filing preparation.
- FTC Safeguards Rule, 16 CFR Part 314FTC Safeguards RuleFTC Safeguards Rule compliance: written risk assessment and security program, MFA and encryption, testing, and FTC breach-notice readiness.
- EU AI Act ReadinessEU AI ActEU AI Act readiness: provider and deployer classification, risk-tier mapping, gap analysis and a roadmap aligned to the Act's phased dates.
Readiness
How readiness works
- 1
Gap assessment
We compare your current controls, policies and evidence against the framework and rank what's missing by risk and effort.
- 2
Remediation plan
A prioritized, owner-assigned plan your team can execute, with the policies and procedures written for you.
- 3
Evidence and readiness
We help implement controls, collect evidence and run a readiness review so there are no surprises.
- 4
Audit support
We stay with you through the independent audit or certification and answer the auditor's follow-up questions.
Crosswalk
One control set, several frameworks
Most security frameworks ask for the same control domains under different clause numbers, so one well-documented program can serve several audits.
| Control domain | SOC 2Trust Services Criteria | ISO 27001ISO/IEC 27001:2022 | PCI DSSv4.0.1 | NIST CSFCSF 2.0 | HIPAA45 CFR 164 Subpart C | NYDFS 50023 NYCRR 500 | FTC Safeguards16 CFR 314 |
|---|---|---|---|---|---|---|---|
| Access control | CC6.1–CC6.3 | A.5.15, A.5.18, A.8.5 | Req. 7, Req. 8 | PR.AA | 164.308(a)(4), 164.312(a)(1), 164.312(d) | 500.7, 500.12 | 314.4(c)(1), (c)(5) |
| Logging and monitoring | CC7.2 | A.8.15, A.8.16 | Req. 10 | DE.CM, DE.AE | 164.308(a)(1)(ii)(D), 164.312(b) | 500.6, 500.14(a)(1) | 314.4(c)(8) |
| Incident response | CC7.3–CC7.5 | A.5.24–A.5.28 | 12.10 | RS.MA, RS.AN, RS.CO, RS.MI, RC.RP | 164.308(a)(6) | 500.16, 500.17 | 314.4(h), (j) |
| Vendor and third-party risk | CC9.2 | A.5.19–A.5.22 | 12.8 | GV.SC | 164.308(b)(1), 164.314(a) | 500.11 | 314.4(f) |
| Risk assessment | CC3.1–CC3.4 | Clauses 6.1.2, 8.2 | 12.3 (targeted risk analysis) | ID.RA | 164.308(a)(1)(ii)(A)–(B) | 500.9 | 314.4(b) |
| Encryption and data protection | CC6.1, CC6.7 | A.8.24 | Req. 3, Req. 4 | PR.DS | 164.312(a)(2)(iv), 164.312(e)(1) | 500.15 | 314.4(c)(3) |
| Change management | CC8.1 | A.8.32 | 6.5 | ID.RA-07, PR.PS-01 | No specific provision | No specific provision | 314.4(c)(7) |
| Security awareness training | CC2.2 | A.6.3 | 12.6 | PR.AT | 164.308(a)(5) | 500.14(a)(3) | 314.4(e) |
Domain-level mapping for orientation, not a control-by-control equivalence; an auditor or assessor decides whether evidence satisfies a specific requirement. A dash means the framework has no explicit provision for that domain.
Sources: AICPA Trust Services Criteria; NIST mapping of ISO/IEC 27001:2022 to CSF 2.0; PCI SSC document library; NIST CSF 2.0; 45 CFR Part 164 Subpart C; 23 NYCRR Part 500; 16 CFR 314.4.
Have an audit or questionnaire coming up?
Tell us the framework and the deadline. We'll scope a gap assessment with a fixed quote.