ISO 27001
The full route from scope statement to certificate.
ExploreFrameworks & gap assessment
Do the work once. Satisfy every framework.
Most companies end up answering to more than one standard: ISO 27001 for customers, SOC 2 for US buyers, DPDP and CERT-In at home, GDPR abroad. CompliLens lets one set of controls serve them all. Pick a framework to see what it brings.
How it works
Four steps from switched on to audit-ready
Each step plays in turn. Choose a step to stop on it; the examples are live, so try them.
Step 1 · Activate
Switch a framework on for your organisation
Choose ISO 27001 and its 93 Annex A controls arrive as editable records, already grouped by theme and mapped to the standard. No spreadsheet import, no retyping.
Step 2 · Map once
One control, counted everywhere it applies
Your encryption control satisfies ISO 27001 8.24, SOC 2 CC6, GDPR Article 32 and RBI's data-protection requirement. Map it once and every framework sees the same status and evidence.
ISO/IEC 27001:2022 · Annex A93 controls
Implemented71
In progress15
Not started6
Not applicable1
| Ref | Control | Status | Maps to |
|---|---|---|---|
| 5.15 | Access control | Implemented | SOC 2 CC6 |
| 8.24 | Use of cryptography | Implemented | GDPR Art. 32 |
| 5.23 | Cloud services security | In progress | RBI |
| 8.30 | Outsourced development | Not applicable | Justified |
Step 3 · Collect evidence
Proof attaches itself
Connectors check your cloud, code, identity and devices every day and attach results to the controls they prove. Uploaded files, policies and training records land in the same place.
Step 4 · Assess gaps
Readiness, scored control by control
Each reference control is graded from your mapped controls and their evidence. Gaps come with a recommendation, and the report exports as a PDF for your board or auditor.
Supported frameworks
Eight frameworks and overlays, one control set
01
ISO/IEC 27001:202293 Annex A controls, provisioned and mapped on activation.
Information security02SOC 2 Type IISecurity, availability, confidentiality, processing integrity and privacy.
Trust Services Criteria03
ISO 9001:2015Clauses 4 to 10, sharing context, objectives and review with ISO 27001.
Quality management04
ISO/IEC 42001:202334 controls, paired with the AI system inventory and impact assessments.
AI management05
06GDPR21 key articles as reference controls, from lawful basis to breach notification.
PrivacyRBI · SEBI · IRDAIOpt-in overlays for banks, market intermediaries and insurers.
Indian regulatorsThe crosswalk
Six controls, five frameworks, one piece of work
Each row is a control you run once. Each cell is a requirement it satisfies. Hover a row to follow it across.
ISO 27001
SOC 2
GDPR
DPDP Act
RBI CSF
Access control
5.15 · 5.18 · 8.5
CC6.1 · CC6.2
Art. 32
Sec. 8(5)
Access control
Encryption
8.24
CC6.1 · CC6.7
Art. 32
Sec. 8(5)
Data protection
Logging & monitoring
8.15 · 8.16
CC7.2
Art. 32
Sec. 8(5)
Continuous surveillance
Incident response
5.24 – 5.26
CC7.3 – CC7.5
Art. 33 · 34
Sec. 8(6)
Incident reporting
Supplier security
5.19 – 5.21
CC9.2
Art. 28
Sec. 8(2)
Vendor risk
Security awareness
6.3
CC1.4 · CC2.2
Art. 39
—
User awareness
Illustrative mapping to help you plan. Article and section references are paraphrased, not legal advice.
Implement a control once, prove it once, and let every framework that needs it count it. That is the difference between running one program and running five.
Regulatory clocks
Reporting windows for nine regimes
| Regime | Jurisdiction | Incident reporting | Data subject requests |
|---|---|---|---|
| CERT-In | India | 6 hours | — |
| DPDP Act | India | — | 30 days · grievance 90 |
| GDPR / UK GDPR | EU / UK | 72 hours | 30 days · 6 rights |
| EU AI Act | EU | 48 hours, strictest tier | — |
| CCPA | California | — | 45 days · opt-out 15 |
| PDPA | Singapore | 72 hours | 30 days |
| LGPD · POPIA | Brazil · South Africa | — | 15 · 30 days |
Framework and regulator content is paraphrased reference material to help you prepare. It is not legal advice, and certificates are issued by independent certification bodies.
Questions
Frameworks, answered
Does CompliLens certify my company?
No. Certificates are issued by independent certification bodies and SOC 2 reports by licensed CPA firms. CompliLens prepares you, collects the evidence they ask for and tracks your certification cycle.
Can we start with one framework and add more later?
Yes. Activate another framework at any time. Controls you already run are mapped across, so you start the second framework partly done.
Can we import our existing Statement of Applicability?
Yes. Import or bulk-update controls from your spreadsheet, matched by reference number.
How is readiness scored?
Each reference control is graded from your mapped controls and their evidence: met counts 100, partial 50, not started 20 and gap 0. Not-applicable controls are excluded.