Organisations pursuing more than one framework typically run separate gap assessments, answer the same underlying questions several times, and produce findings that cannot be reconciled.
This workbook inverts that. You assess against a single set of 218 unified control statements, and the cross-mapping engine reports your position against each framework independently — including which gaps are shared and therefore highest priority.
The output includes a remediation backlog sized in effort, sequenced by dependency, and annotated with which frameworks each item unblocks.
Why it is structured the way it is, and the failure patterns it was designed around.
The choice is decided by who is buying, not by which framework is better. A practical decision guide, plus why sequencing ISO first makes the SOC 2 cheaper and the reverse is not true.
A working risk register with a pre-populated scenario library, quantified exposure model and treatment tracking — not an empty template.
Most organisations discover their first real gap during an audit or an incident. The assessment surfaces it in fifteen minutes instead — scored, benchmarked and prioritised, with nothing to buy.
Built for
Kept current
Version 4.0, revised 8 July 2026. We update when a framework changes, when new rules are notified, or when an engagement teaches us something that improves it.
XLSX · 18 pages
What this will not do
A template cannot know your systems, test your controls or make the judgement calls that determine whether a programme holds up in an audit. Use it to move faster, not to skip the thinking — and treat any resource claiming to make you compliant on its own as a warning about its author.
Access review is one control that answers ISO 27001, SOC 2, DPDPA, PCI DSS and NIST CSF. Here is how to build the library so a single implementation serves all of them.
Tiering model plus four proportionate question sets, so a low-risk vendor answers eight questions and a critical one gets genuine scrutiny.
A DPDPA-conformant notice set — customer, employee, vendor and website — with itemised processing tables and multilingual structure built in.
Your position across privacy, security, governance, risk and AI accountability, scored against sector benchmarks rather than a generic scale.
The specific gaps that matter most for your sector and size, ordered by risk reduction rather than by framework clause number.
Where you stand against DPDPA, ISO 27001, ISO 42001 and SOC 2 — and which of them your buyers are most likely to ask for next.
No sales call required to see your results. Take it, read the output, and decide independently whether you want to talk to anyone.
