Solutions
Compliance programmes by industry
The frameworks are the same everywhere; the pressure is not. Each industry below pairs its regulatory load with the evidence that load produces, and with the points where the work tends to pile up before an audit.
SOC 2 · PCI DSS · ISO 27001
Financial services
Banks, insurers, and payment firms run SOC 2 beside PCI DSS and local prudential rules. Evidence is shared across all three, and examination requests stop being a fire drill.
Where the work piles up
- Card scheme and regulator evidence overlap, but formats differ
- Vendor reviews for processors and bureaus renew on staggered dates
- Examination requests arrive with short deadlines and long document lists
Framework mapping
Sample data Typical evidence is drawn from the tracked sample checklist in each framework guide.
| Framework | Typical evidence |
|---|---|
| SOC 2 | Logical access restricted to authorised users; Encryption for data in transit and at rest; Change tickets approved before deployment; Incident response plan tested in the period; Vendor reviews completed for critical suppliers |
| PCI DSS | Stored account data inventory verified; Multi-factor authentication for all remote access; Vulnerability scans run and findings triaged; Incident response plan roles confirmed |
| ISO 27001 | Information security policies approved and published; Privileged access reviewed quarterly; Backups tested with a restore exercise; Security awareness training completed by all staff; Supplier security requirements in contracts |
HIPAA · SOC 2 · ISO 27001
Healthcare
Providers and health technology firms hold HIPAA alongside SOC 2. Business associate agreements, workforce training records, and access reviews live in one register with dates attached.
Where the work piles up
- Business associate agreements scattered across contract files
- Access reviews for clinical systems are manual and slow
- Breach-notification clocks start before the paperwork is found
Framework mapping
Sample data Typical evidence is drawn from the tracked sample checklist in each framework guide.
| Framework | Typical evidence |
|---|---|
| HIPAA | Risk analysis refreshed for the current year; Workforce clearance records complete; Audit controls enabled on systems holding ePHI; Business associate agreements signed and filed |
| SOC 2 | Logical access restricted to authorised users; Encryption for data in transit and at rest; Change tickets approved before deployment; Incident response plan tested in the period; Vendor reviews completed for critical suppliers |
| ISO 27001 | Information security policies approved and published; Privileged access reviewed quarterly; Backups tested with a restore exercise; Security awareness training completed by all staff; Supplier security requirements in contracts |
SOC 2 · ISO 27001 · GDPR
Software and SaaS
Software vendors win enterprise deals by answering security reviews fast and passing SOC 2 and ISO 27001 audits on a fixed calendar. A public trust center shortens both.
Where the work piles up
- Enterprise questionnaires ask the same questions in new formats
- Audit scope grows with every new product line and region
- Security review becomes the bottleneck in late-stage deals
Framework mapping
Sample data Typical evidence is drawn from the tracked sample checklist in each framework guide.
| Framework | Typical evidence |
|---|---|
| SOC 2 | Logical access restricted to authorised users; Encryption for data in transit and at rest; Change tickets approved before deployment; Incident response plan tested in the period; Vendor reviews completed for critical suppliers |
| ISO 27001 | Information security policies approved and published; Privileged access reviewed quarterly; Backups tested with a restore exercise; Security awareness training completed by all staff; Supplier security requirements in contracts |
| GDPR | Record of processing activities current; Pseudonymisation applied to analytics exports; Breach notification procedure rehearsed; Impact assessment for the new data product |
PCI DSS · CCPA / CPRA · SOC 2
Retail and e-commerce
Retail groups carry PCI DSS for payments and privacy duties for customer data across stores and online channels. Seasonal headcount changes are handled as scheduled access events, not surprises.
Where the work piles up
- Seasonal staff churn breaks access review schedules
- Payment scope creeps as new channels and stores open
- Privacy requests spike after marketing campaigns
Framework mapping
Sample data Typical evidence is drawn from the tracked sample checklist in each framework guide.
| Framework | Typical evidence |
|---|---|
| PCI DSS | Stored account data inventory verified; Multi-factor authentication for all remote access; Vulnerability scans run and findings triaged; Incident response plan roles confirmed |
| CCPA / CPRA | Opt-out requests honoured within the deadline; Consumer request log reviewed monthly; Notice at collection updated on all forms |
| SOC 2 | Logical access restricted to authorised users; Encryption for data in transit and at rest; Change tickets approved before deployment; Incident response plan tested in the period; Vendor reviews completed for critical suppliers |
ISO 27001 · SOC 2 · GDPR
Manufacturing and logistics
Manufacturers face customer audits from automotive and industrial buyers on top of ISO 27001. Supplier assessments and plant-level evidence are collected in formats those audits accept.
Where the work piles up
- Plant systems and office IT sit in different evidence worlds
- Customer audits follow automotive and aerospace formats of their own
- Supplier assessments cover hundreds of small firms with no security staff
Framework mapping
Sample data Typical evidence is drawn from the tracked sample checklist in each framework guide.
| Framework | Typical evidence |
|---|---|
| ISO 27001 | Information security policies approved and published; Privileged access reviewed quarterly; Backups tested with a restore exercise; Security awareness training completed by all staff; Supplier security requirements in contracts |
| SOC 2 | Logical access restricted to authorised users; Encryption for data in transit and at rest; Change tickets approved before deployment; Incident response plan tested in the period; Vendor reviews completed for critical suppliers |
| GDPR | Record of processing activities current; Pseudonymisation applied to analytics exports; Breach notification procedure rehearsed; Impact assessment for the new data product |
Run one programme across every framework
See how the evidence for your industry is collected once and mapped to each framework that asks for it. A demo takes about thirty minutes and uses your own framework list.