Coverage
Which frameworks each platform claims
For each of 127vendors, one page on the vendor's own site was read and every framework it says the product covers was recorded, with the page and the date. 106 vendors have been read; the other 21 have no readable framework page, and say so rather than showing an empty row. Nobody pays to appear, and nothing here is ranked.
Read this before reading the table
A blank cell means the vendor does not claim this on its own site. It does not mean the vendor cannot do it. Vendors document unevenly, and plenty of platforms handle a framework they never put on a marketing page. Treat a blank as a question to ask on a sales call, not as an answer.
A filled cell is a claim, not a certification. It records what the vendor says, checked against nothing except the vendor's own words on the date shown.
Legend
- ● Claims it
- · Does not claim it
- ? Mentions it, not as a claim
- – Not checked
How often each framework is claimed
| Framework | Vendors claiming it | Share of those checked |
|---|---|---|
| SOC 2 | 42 | 40% |
| ISO 27001 | 46 | 43% |
| ISO 42001 | 23 | 22% |
| GDPR | 54 | 51% |
| HIPAA | 47 | 44% |
| PCI DSS | 33 | 31% |
| NIST CSF / 800-53 | 25 | 24% |
| FedRAMP | 14 | 13% |
| CMMC | 21 | 20% |
| EU AI Act | 20 | 19% |
| DORA | 20 | 19% |
| NIS2 | 18 | 17% |
Every vendor
Scroll sideways on a narrow screen. Each vendor name links to its profile, where the page that was read and the date it was read are printed in full.
| Vendor | SOC 2 | ISO 27001 | ISO 42001 | GDPR | HIPAA | PCI DSS | NIST | FedRAMP | CMMC | EU AI Act | DORA | NIS2 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 6clicksEnterprise GRC platform | 6clicks claims SOC 2 on its own site | 6clicks claims ISO 27001 on its own site | 6clicks claims ISO 42001 on its own site | 6clicks does not claim GDPR on its own site | 6clicks does not claim HIPAA on its own site | 6clicks claims PCI DSS on its own site | 6clicks claims NIST CSF / 800-53 on its own site | 6clicks does not claim FedRAMP on its own site | 6clicks claims CMMC on its own site | 6clicks does not claim EU AI Act on its own site | 6clicks claims DORA on its own site | 6clicks claims NIS2 on its own site |
| AccessOwlEnterprise GRC platform | AccessOwl claims SOC 2 on its own site | AccessOwl claims ISO 27001 on its own site | AccessOwl does not claim ISO 42001 on its own site | AccessOwl does not claim GDPR on its own site | AccessOwl does not claim HIPAA on its own site | AccessOwl does not claim PCI DSS on its own site | AccessOwl does not claim NIST CSF / 800-53 on its own site | AccessOwl does not claim FedRAMP on its own site | AccessOwl does not claim CMMC on its own site | AccessOwl does not claim EU AI Act on its own site | AccessOwl does not claim DORA on its own site | AccessOwl does not claim NIS2 on its own site |
| Affil.aiIndustry-specific | Affil.ai was not checked for SOC 2 | Affil.ai was not checked for ISO 27001 | Affil.ai was not checked for ISO 42001 | Affil.ai was not checked for GDPR | Affil.ai was not checked for HIPAA | Affil.ai was not checked for PCI DSS | Affil.ai was not checked for NIST CSF / 800-53 | Affil.ai was not checked for FedRAMP | Affil.ai was not checked for CMMC | Affil.ai was not checked for EU AI Act | Affil.ai was not checked for DORA | Affil.ai was not checked for NIS2 |
| Affinity (compliance training)Compliance training | Affinity (compliance training) does not claim SOC 2 on its own site | Affinity (compliance training) does not claim ISO 27001 on its own site | Affinity (compliance training) does not claim ISO 42001 on its own site | Affinity (compliance training) claims GDPR on its own site | Affinity (compliance training) claims HIPAA on its own site | Affinity (compliance training) claims PCI DSS on its own site | Affinity (compliance training) does not claim NIST CSF / 800-53 on its own site | Affinity (compliance training) does not claim FedRAMP on its own site | Affinity (compliance training) does not claim CMMC on its own site | Affinity (compliance training) does not claim EU AI Act on its own site | Affinity (compliance training) does not claim DORA on its own site | Affinity (compliance training) does not claim NIS2 on its own site |
| AlloyFinancial services compliance | Alloy was not checked for SOC 2 | Alloy was not checked for ISO 27001 | Alloy was not checked for ISO 42001 | Alloy was not checked for GDPR | Alloy was not checked for HIPAA | Alloy was not checked for PCI DSS | Alloy was not checked for NIST CSF / 800-53 | Alloy was not checked for FedRAMP | Alloy was not checked for CMMC | Alloy was not checked for EU AI Act | Alloy was not checked for DORA | Alloy was not checked for NIS2 |
| AnecdotesEnterprise GRC platform | Anecdotes claims SOC 2 on its own site | Anecdotes claims ISO 27001 on its own site | Anecdotes claims ISO 42001 on its own site | Anecdotes claims GDPR on its own site | Anecdotes claims HIPAA on its own site | Anecdotes claims PCI DSS on its own site | Anecdotes claims NIST CSF / 800-53 on its own site | Anecdotes claims FedRAMP on its own site | Anecdotes does not claim CMMC on its own site | Anecdotes does not claim EU AI Act on its own site | Anecdotes claims DORA on its own site | Anecdotes does not claim NIS2 on its own site |
| ArchonIndustry-specific | Archon does not claim SOC 2 on its own site | Archon does not claim ISO 27001 on its own site | Archon does not claim ISO 42001 on its own site | Archon does not claim GDPR on its own site | Archon does not claim HIPAA on its own site | Archon does not claim PCI DSS on its own site | Archon claims NIST CSF / 800-53 on its own site | Archon claims FedRAMP on its own site | Archon does not claim CMMC on its own site | Archon does not claim EU AI Act on its own site | Archon does not claim DORA on its own site | Archon does not claim NIS2 on its own site |
| Arva AIFinancial services compliance | Arva AI does not claim SOC 2 on its own site | Arva AI does not claim ISO 27001 on its own site | Arva AI does not claim ISO 42001 on its own site | Arva AI does not claim GDPR on its own site | Arva AI does not claim HIPAA on its own site | Arva AI does not claim PCI DSS on its own site | Arva AI does not claim NIST CSF / 800-53 on its own site | Arva AI does not claim FedRAMP on its own site | Arva AI does not claim CMMC on its own site | Arva AI does not claim EU AI Act on its own site | Arva AI does not claim DORA on its own site | Arva AI does not claim NIS2 on its own site |
| AvalaraTax and e-invoicing | Avalara was not checked for SOC 2 | Avalara was not checked for ISO 27001 | Avalara was not checked for ISO 42001 | Avalara was not checked for GDPR | Avalara was not checked for HIPAA | Avalara was not checked for PCI DSS | Avalara was not checked for NIST CSF / 800-53 | Avalara was not checked for FedRAMP | Avalara was not checked for CMMC | Avalara was not checked for EU AI Act | Avalara was not checked for DORA | Avalara was not checked for NIS2 |
| BigIDPrivacy and data governance | BigID does not claim SOC 2 on its own site | BigID mentions ISO 27001, but not as a coverage claim | BigID does not claim ISO 42001 on its own site | BigID claims GDPR on its own site | BigID claims HIPAA on its own site | BigID claims PCI DSS on its own site | BigID mentions NIST CSF / 800-53, but not as a coverage claim | BigID does not claim FedRAMP on its own site | BigID claims CMMC on its own site | BigID claims EU AI Act on its own site | BigID claims DORA on its own site | BigID does not claim NIS2 on its own site |
| BorneoPrivacy and data governance | Borneo was not checked for SOC 2 | Borneo was not checked for ISO 27001 | Borneo was not checked for ISO 42001 | Borneo was not checked for GDPR | Borneo was not checked for HIPAA | Borneo was not checked for PCI DSS | Borneo was not checked for NIST CSF / 800-53 | Borneo was not checked for FedRAMP | Borneo was not checked for CMMC | Borneo was not checked for EU AI Act | Borneo was not checked for DORA | Borneo was not checked for NIS2 |
| Bretton AIFinancial services compliance | Bretton AI was not checked for SOC 2 | Bretton AI was not checked for ISO 27001 | Bretton AI was not checked for ISO 42001 | Bretton AI was not checked for GDPR | Bretton AI was not checked for HIPAA | Bretton AI was not checked for PCI DSS | Bretton AI was not checked for NIST CSF / 800-53 | Bretton AI was not checked for FedRAMP | Bretton AI was not checked for CMMC | Bretton AI was not checked for EU AI Act | Bretton AI was not checked for DORA | Bretton AI was not checked for NIS2 |
| CardamonEnterprise GRC platform | Cardamon was not checked for SOC 2 | Cardamon was not checked for ISO 27001 | Cardamon was not checked for ISO 42001 | Cardamon was not checked for GDPR | Cardamon was not checked for HIPAA | Cardamon was not checked for PCI DSS | Cardamon was not checked for NIST CSF / 800-53 | Cardamon was not checked for FedRAMP | Cardamon was not checked for CMMC | Cardamon was not checked for EU AI Act | Cardamon was not checked for DORA | Cardamon was not checked for NIS2 |
| CensinetThird-party risk | Censinet mentions SOC 2, but not as a coverage claim | Censinet does not claim ISO 27001 on its own site | Censinet does not claim ISO 42001 on its own site | Censinet does not claim GDPR on its own site | Censinet mentions HIPAA, but not as a coverage claim | Censinet does not claim PCI DSS on its own site | Censinet claims NIST CSF / 800-53 on its own site | Censinet does not claim FedRAMP on its own site | Censinet does not claim CMMC on its own site | Censinet does not claim EU AI Act on its own site | Censinet does not claim DORA on its own site | Censinet does not claim NIS2 on its own site |
| CertaThird-party risk | Certa does not claim SOC 2 on its own site | Certa does not claim ISO 27001 on its own site | Certa does not claim ISO 42001 on its own site | Certa does not claim GDPR on its own site | Certa does not claim HIPAA on its own site | Certa does not claim PCI DSS on its own site | Certa does not claim NIST CSF / 800-53 on its own site | Certa does not claim FedRAMP on its own site | Certa does not claim CMMC on its own site | Certa does not claim EU AI Act on its own site | Certa does not claim DORA on its own site | Certa does not claim NIS2 on its own site |
| CertivoSupply chain and ESG | Certivo does not claim SOC 2 on its own site | Certivo does not claim ISO 27001 on its own site | Certivo does not claim ISO 42001 on its own site | Certivo does not claim GDPR on its own site | Certivo does not claim HIPAA on its own site | Certivo does not claim PCI DSS on its own site | Certivo does not claim NIST CSF / 800-53 on its own site | Certivo does not claim FedRAMP on its own site | Certivo claims CMMC on its own site | Certivo does not claim EU AI Act on its own site | Certivo does not claim DORA on its own site | Certivo does not claim NIS2 on its own site |
| CinderIndustry-specific | Cinder mentions SOC 2, but not as a coverage claim | Cinder does not claim ISO 27001 on its own site | Cinder does not claim ISO 42001 on its own site | Cinder mentions GDPR, but not as a coverage claim | Cinder mentions HIPAA, but not as a coverage claim | Cinder does not claim PCI DSS on its own site | Cinder does not claim NIST CSF / 800-53 on its own site | Cinder does not claim FedRAMP on its own site | Cinder does not claim CMMC on its own site | Cinder does not claim EU AI Act on its own site | Cinder does not claim DORA on its own site | Cinder does not claim NIS2 on its own site |
| CloudSphereEnterprise GRC platform | CloudSphere was not checked for SOC 2 | CloudSphere was not checked for ISO 27001 | CloudSphere was not checked for ISO 42001 | CloudSphere was not checked for GDPR | CloudSphere was not checked for HIPAA | CloudSphere was not checked for PCI DSS | CloudSphere was not checked for NIST CSF / 800-53 | CloudSphere was not checked for FedRAMP | CloudSphere was not checked for CMMC | CloudSphere was not checked for EU AI Act | CloudSphere was not checked for DORA | CloudSphere was not checked for NIS2 |
| Comp AI (Bubba AI)SOC 2 and ISO 27001 automation | Comp AI (Bubba AI) claims SOC 2 on its own site | Comp AI (Bubba AI) claims ISO 27001 on its own site | Comp AI (Bubba AI) mentions ISO 42001, but not as a coverage claim | Comp AI (Bubba AI) claims GDPR on its own site | Comp AI (Bubba AI) claims HIPAA on its own site | Comp AI (Bubba AI) does not claim PCI DSS on its own site | Comp AI (Bubba AI) does not claim NIST CSF / 800-53 on its own site | Comp AI (Bubba AI) claims FedRAMP on its own site | Comp AI (Bubba AI) does not claim CMMC on its own site | Comp AI (Bubba AI) does not claim EU AI Act on its own site | Comp AI (Bubba AI) does not claim DORA on its own site | Comp AI (Bubba AI) does not claim NIS2 on its own site |
| ComplianceQuestIndustry-specific | ComplianceQuest was not checked for SOC 2 | ComplianceQuest was not checked for ISO 27001 | ComplianceQuest was not checked for ISO 42001 | ComplianceQuest was not checked for GDPR | ComplianceQuest was not checked for HIPAA | ComplianceQuest was not checked for PCI DSS | ComplianceQuest was not checked for NIST CSF / 800-53 | ComplianceQuest was not checked for FedRAMP | ComplianceQuest was not checked for CMMC | ComplianceQuest was not checked for EU AI Act | ComplianceQuest was not checked for DORA | ComplianceQuest was not checked for NIS2 |
| ComplyAdvantageFinancial services compliance | ComplyAdvantage mentions SOC 2, but not as a coverage claim | ComplyAdvantage mentions ISO 27001, but not as a coverage claim | ComplyAdvantage does not claim ISO 42001 on its own site | ComplyAdvantage mentions GDPR, but not as a coverage claim | ComplyAdvantage does not claim HIPAA on its own site | ComplyAdvantage does not claim PCI DSS on its own site | ComplyAdvantage does not claim NIST CSF / 800-53 on its own site | ComplyAdvantage does not claim FedRAMP on its own site | ComplyAdvantage does not claim CMMC on its own site | ComplyAdvantage does not claim EU AI Act on its own site | ComplyAdvantage does not claim DORA on its own site | ComplyAdvantage does not claim NIS2 on its own site |
| ComplyanceEnterprise GRC platform | Complyance mentions SOC 2, but not as a coverage claim | Complyance mentions ISO 27001, but not as a coverage claim | Complyance does not claim ISO 42001 on its own site | Complyance mentions GDPR, but not as a coverage claim | Complyance does not claim HIPAA on its own site | Complyance does not claim PCI DSS on its own site | Complyance does not claim NIST CSF / 800-53 on its own site | Complyance does not claim FedRAMP on its own site | Complyance does not claim CMMC on its own site | Complyance does not claim EU AI Act on its own site | Complyance does not claim DORA on its own site | Complyance does not claim NIS2 on its own site |
| ComplyDoEnterprise GRC platform | ComplyDo claims SOC 2 on its own site | ComplyDo claims ISO 27001 on its own site | ComplyDo claims ISO 42001 on its own site | ComplyDo claims GDPR on its own site | ComplyDo claims HIPAA on its own site | ComplyDo does not claim PCI DSS on its own site | ComplyDo mentions NIST CSF / 800-53, but not as a coverage claim | ComplyDo does not claim FedRAMP on its own site | ComplyDo does not claim CMMC on its own site | ComplyDo claims EU AI Act on its own site | ComplyDo claims DORA on its own site | ComplyDo claims NIS2 on its own site |
| Compuvi (Confinaid)Enterprise GRC platform | Compuvi (Confinaid) was not checked for SOC 2 | Compuvi (Confinaid) was not checked for ISO 27001 | Compuvi (Confinaid) was not checked for ISO 42001 | Compuvi (Confinaid) was not checked for GDPR | Compuvi (Confinaid) was not checked for HIPAA | Compuvi (Confinaid) was not checked for PCI DSS | Compuvi (Confinaid) was not checked for NIST CSF / 800-53 | Compuvi (Confinaid) was not checked for FedRAMP | Compuvi (Confinaid) was not checked for CMMC | Compuvi (Confinaid) was not checked for EU AI Act | Compuvi (Confinaid) was not checked for DORA | Compuvi (Confinaid) was not checked for NIS2 |
| CompylEnterprise GRC platform | Compyl claims SOC 2 on its own site | Compyl claims ISO 27001 on its own site | Compyl claims ISO 42001 on its own site | Compyl claims GDPR on its own site | Compyl claims HIPAA on its own site | Compyl claims PCI DSS on its own site | Compyl claims NIST CSF / 800-53 on its own site | Compyl claims FedRAMP on its own site | Compyl claims CMMC on its own site | Compyl claims EU AI Act on its own site | Compyl claims DORA on its own site | Compyl mentions NIS2, but not as a coverage claim |
| ControlMapSOC 2 and ISO 27001 automation | ControlMap claims SOC 2 on its own site | ControlMap claims ISO 27001 on its own site | ControlMap does not claim ISO 42001 on its own site | ControlMap claims GDPR on its own site | ControlMap claims HIPAA on its own site | ControlMap claims PCI DSS on its own site | ControlMap claims NIST CSF / 800-53 on its own site | ControlMap does not claim FedRAMP on its own site | ControlMap claims CMMC on its own site | ControlMap does not claim EU AI Act on its own site | ControlMap claims DORA on its own site | ControlMap does not claim NIS2 on its own site |
| ConveyorQuestionnaires and trust centers | Conveyor mentions SOC 2, but not as a coverage claim | Conveyor does not claim ISO 27001 on its own site | Conveyor does not claim ISO 42001 on its own site | Conveyor does not claim GDPR on its own site | Conveyor does not claim HIPAA on its own site | Conveyor does not claim PCI DSS on its own site | Conveyor does not claim NIST CSF / 800-53 on its own site | Conveyor does not claim FedRAMP on its own site | Conveyor does not claim CMMC on its own site | Conveyor does not claim EU AI Act on its own site | Conveyor does not claim DORA on its own site | Conveyor does not claim NIS2 on its own site |
| CoplaSOC 2 and ISO 27001 automation | Copla claims SOC 2 on its own site | Copla claims ISO 27001 on its own site | Copla claims ISO 42001 on its own site | Copla claims GDPR on its own site | Copla claims HIPAA on its own site | Copla claims PCI DSS on its own site | Copla mentions NIST CSF / 800-53, but not as a coverage claim | Copla does not claim FedRAMP on its own site | Copla does not claim CMMC on its own site | Copla claims EU AI Act on its own site | Copla claims DORA on its own site | Copla claims NIS2 on its own site |
| CotoolSOC 2 and ISO 27001 automation | Cotool was not checked for SOC 2 | Cotool was not checked for ISO 27001 | Cotool was not checked for ISO 42001 | Cotool was not checked for GDPR | Cotool was not checked for HIPAA | Cotool was not checked for PCI DSS | Cotool was not checked for NIST CSF / 800-53 | Cotool was not checked for FedRAMP | Cotool was not checked for CMMC | Cotool was not checked for EU AI Act | Cotool was not checked for DORA | Cotool was not checked for NIS2 |
| CRACIIndustry-specific | CRACI does not claim SOC 2 on its own site | CRACI does not claim ISO 27001 on its own site | CRACI does not claim ISO 42001 on its own site | CRACI does not claim GDPR on its own site | CRACI does not claim HIPAA on its own site | CRACI does not claim PCI DSS on its own site | CRACI does not claim NIST CSF / 800-53 on its own site | CRACI does not claim FedRAMP on its own site | CRACI does not claim CMMC on its own site | CRACI does not claim EU AI Act on its own site | CRACI does not claim DORA on its own site | CRACI mentions NIS2, but not as a coverage claim |
| Credo AIAI governance | Credo AI claims SOC 2 on its own site | Credo AI does not claim ISO 27001 on its own site | Credo AI claims ISO 42001 on its own site | Credo AI does not claim GDPR on its own site | Credo AI does not claim HIPAA on its own site | Credo AI does not claim PCI DSS on its own site | Credo AI does not claim NIST CSF / 800-53 on its own site | Credo AI does not claim FedRAMP on its own site | Credo AI does not claim CMMC on its own site | Credo AI claims EU AI Act on its own site | Credo AI does not claim DORA on its own site | Credo AI does not claim NIS2 on its own site |
| CyberSmartSOC 2 and ISO 27001 automation | CyberSmart claims SOC 2 on its own site | CyberSmart claims ISO 27001 on its own site | CyberSmart does not claim ISO 42001 on its own site | CyberSmart claims GDPR on its own site | CyberSmart does not claim HIPAA on its own site | CyberSmart does not claim PCI DSS on its own site | CyberSmart does not claim NIST CSF / 800-53 on its own site | CyberSmart does not claim FedRAMP on its own site | CyberSmart does not claim CMMC on its own site | CyberSmart does not claim EU AI Act on its own site | CyberSmart does not claim DORA on its own site | CyberSmart claims NIS2 on its own site |
| DataGrailPrivacy and data governance | DataGrail does not claim SOC 2 on its own site | DataGrail does not claim ISO 27001 on its own site | DataGrail does not claim ISO 42001 on its own site | DataGrail claims GDPR on its own site | DataGrail does not claim HIPAA on its own site | DataGrail does not claim PCI DSS on its own site | DataGrail does not claim NIST CSF / 800-53 on its own site | DataGrail does not claim FedRAMP on its own site | DataGrail does not claim CMMC on its own site | DataGrail does not claim EU AI Act on its own site | DataGrail does not claim DORA on its own site | DataGrail does not claim NIS2 on its own site |
| DataGuardPrivacy and data governance | DataGuard does not claim SOC 2 on its own site | DataGuard claims ISO 27001 on its own site | DataGuard does not claim ISO 42001 on its own site | DataGuard claims GDPR on its own site | DataGuard does not claim HIPAA on its own site | DataGuard does not claim PCI DSS on its own site | DataGuard does not claim NIST CSF / 800-53 on its own site | DataGuard does not claim FedRAMP on its own site | DataGuard does not claim CMMC on its own site | DataGuard claims EU AI Act on its own site | DataGuard does not claim DORA on its own site | DataGuard claims NIS2 on its own site |
| DelveSOC 2 and ISO 27001 automation | Delve claims SOC 2 on its own site | Delve claims ISO 27001 on its own site | Delve claims ISO 42001 on its own site | Delve claims GDPR on its own site | Delve claims HIPAA on its own site | Delve claims PCI DSS on its own site | Delve does not claim NIST CSF / 800-53 on its own site | Delve claims FedRAMP on its own site | Delve claims CMMC on its own site | Delve claims EU AI Act on its own site | Delve does not claim DORA on its own site | Delve does not claim NIS2 on its own site |
| DenkiEnterprise GRC platform | Denki was not checked for SOC 2 | Denki was not checked for ISO 27001 | Denki was not checked for ISO 42001 | Denki was not checked for GDPR | Denki was not checked for HIPAA | Denki was not checked for PCI DSS | Denki was not checked for NIST CSF / 800-53 | Denki was not checked for FedRAMP | Denki was not checked for CMMC | Denki was not checked for EU AI Act | Denki was not checked for DORA | Denki was not checked for NIS2 |
| diliIndustry-specific | dili does not claim SOC 2 on its own site | dili does not claim ISO 27001 on its own site | dili does not claim ISO 42001 on its own site | dili does not claim GDPR on its own site | dili does not claim HIPAA on its own site | dili does not claim PCI DSS on its own site | dili does not claim NIST CSF / 800-53 on its own site | dili does not claim FedRAMP on its own site | dili does not claim CMMC on its own site | dili does not claim EU AI Act on its own site | dili does not claim DORA on its own site | dili does not claim NIS2 on its own site |
| DiscloHealthcare compliance | Disclo does not claim SOC 2 on its own site | Disclo does not claim ISO 27001 on its own site | Disclo does not claim ISO 42001 on its own site | Disclo does not claim GDPR on its own site | Disclo mentions HIPAA, but not as a coverage claim | Disclo does not claim PCI DSS on its own site | Disclo does not claim NIST CSF / 800-53 on its own site | Disclo does not claim FedRAMP on its own site | Disclo does not claim CMMC on its own site | Disclo does not claim EU AI Act on its own site | Disclo does not claim DORA on its own site | Disclo does not claim NIS2 on its own site |
| DrataSOC 2 and ISO 27001 automation | Drata claims SOC 2 on its own site | Drata claims ISO 27001 on its own site | Drata claims ISO 42001 on its own site | Drata claims GDPR on its own site | Drata claims HIPAA on its own site | Drata claims PCI DSS on its own site | Drata claims NIST CSF / 800-53 on its own site | Drata claims FedRAMP on its own site | Drata claims CMMC on its own site | Drata mentions EU AI Act, but not as a coverage claim | Drata claims DORA on its own site | Drata claims NIS2 on its own site |
| EcoVadisSupply chain and ESG | EcoVadis does not claim SOC 2 on its own site | EcoVadis does not claim ISO 27001 on its own site | EcoVadis does not claim ISO 42001 on its own site | EcoVadis does not claim GDPR on its own site | EcoVadis does not claim HIPAA on its own site | EcoVadis does not claim PCI DSS on its own site | EcoVadis does not claim NIST CSF / 800-53 on its own site | EcoVadis does not claim FedRAMP on its own site | EcoVadis does not claim CMMC on its own site | EcoVadis does not claim EU AI Act on its own site | EcoVadis does not claim DORA on its own site | EcoVadis does not claim NIS2 on its own site |
| EthenaCompliance training | Ethena does not claim SOC 2 on its own site | Ethena claims ISO 27001 on its own site | Ethena does not claim ISO 42001 on its own site | Ethena claims GDPR on its own site | Ethena claims HIPAA on its own site | Ethena claims PCI DSS on its own site | Ethena does not claim NIST CSF / 800-53 on its own site | Ethena claims FedRAMP on its own site | Ethena does not claim CMMC on its own site | Ethena does not claim EU AI Act on its own site | Ethena does not claim DORA on its own site | Ethena does not claim NIS2 on its own site |
| FairNowAI governance | FairNow does not claim SOC 2 on its own site | FairNow does not claim ISO 27001 on its own site | FairNow claims ISO 42001 on its own site | FairNow does not claim GDPR on its own site | FairNow does not claim HIPAA on its own site | FairNow does not claim PCI DSS on its own site | FairNow mentions NIST CSF / 800-53, but not as a coverage claim | FairNow does not claim FedRAMP on its own site | FairNow does not claim CMMC on its own site | FairNow claims EU AI Act on its own site | FairNow does not claim DORA on its own site | FairNow does not claim NIS2 on its own site |
| FlosumEnterprise GRC platform | Flosum mentions SOC 2, but not as a coverage claim | Flosum mentions ISO 27001, but not as a coverage claim | Flosum does not claim ISO 42001 on its own site | Flosum mentions GDPR, but not as a coverage claim | Flosum mentions HIPAA, but not as a coverage claim | Flosum mentions PCI DSS, but not as a coverage claim | Flosum mentions NIST CSF / 800-53, but not as a coverage claim | Flosum does not claim FedRAMP on its own site | Flosum does not claim CMMC on its own site | Flosum does not claim EU AI Act on its own site | Flosum does not claim DORA on its own site | Flosum does not claim NIS2 on its own site |
| GaliniAI governance | Galini was not checked for SOC 2 | Galini was not checked for ISO 27001 | Galini was not checked for ISO 42001 | Galini was not checked for GDPR | Galini was not checked for HIPAA | Galini was not checked for PCI DSS | Galini was not checked for NIST CSF / 800-53 | Galini was not checked for FedRAMP | Galini was not checked for CMMC | Galini was not checked for EU AI Act | Galini was not checked for DORA | Galini was not checked for NIS2 |
| GreenboardFinancial services compliance | Greenboard mentions SOC 2, but not as a coverage claim | Greenboard does not claim ISO 27001 on its own site | Greenboard does not claim ISO 42001 on its own site | Greenboard does not claim GDPR on its own site | Greenboard does not claim HIPAA on its own site | Greenboard does not claim PCI DSS on its own site | Greenboard does not claim NIST CSF / 800-53 on its own site | Greenboard does not claim FedRAMP on its own site | Greenboard does not claim CMMC on its own site | Greenboard does not claim EU AI Act on its own site | Greenboard does not claim DORA on its own site | Greenboard does not claim NIS2 on its own site |
| HaastIndustry-specific | Haast does not claim SOC 2 on its own site | Haast does not claim ISO 27001 on its own site | Haast does not claim ISO 42001 on its own site | Haast claims GDPR on its own site | Haast claims HIPAA on its own site | Haast does not claim PCI DSS on its own site | Haast does not claim NIST CSF / 800-53 on its own site | Haast does not claim FedRAMP on its own site | Haast does not claim CMMC on its own site | Haast does not claim EU AI Act on its own site | Haast does not claim DORA on its own site | Haast does not claim NIS2 on its own site |
| HadriusFinancial services compliance | Hadrius mentions SOC 2, but not as a coverage claim | Hadrius does not claim ISO 27001 on its own site | Hadrius does not claim ISO 42001 on its own site | Hadrius does not claim GDPR on its own site | Hadrius does not claim HIPAA on its own site | Hadrius does not claim PCI DSS on its own site | Hadrius does not claim NIST CSF / 800-53 on its own site | Hadrius does not claim FedRAMP on its own site | Hadrius does not claim CMMC on its own site | Hadrius does not claim EU AI Act on its own site | Hadrius does not claim DORA on its own site | Hadrius does not claim NIS2 on its own site |
| Holistic AIAI governance | Holistic AI mentions SOC 2, but not as a coverage claim | Holistic AI does not claim ISO 27001 on its own site | Holistic AI claims ISO 42001 on its own site | Holistic AI does not claim GDPR on its own site | Holistic AI does not claim HIPAA on its own site | Holistic AI does not claim PCI DSS on its own site | Holistic AI mentions NIST CSF / 800-53, but not as a coverage claim | Holistic AI does not claim FedRAMP on its own site | Holistic AI does not claim CMMC on its own site | Holistic AI claims EU AI Act on its own site | Holistic AI does not claim DORA on its own site | Holistic AI does not claim NIS2 on its own site |
| HyperproofEnterprise GRC platform | Hyperproof claims SOC 2 on its own site | Hyperproof claims ISO 27001 on its own site | Hyperproof does not claim ISO 42001 on its own site | Hyperproof claims GDPR on its own site | Hyperproof claims HIPAA on its own site | Hyperproof claims PCI DSS on its own site | Hyperproof claims NIST CSF / 800-53 on its own site | Hyperproof claims FedRAMP on its own site | Hyperproof claims CMMC on its own site | Hyperproof does not claim EU AI Act on its own site | Hyperproof claims DORA on its own site | Hyperproof claims NIS2 on its own site |
| IntelliGRCIndustry-specific | IntelliGRC claims SOC 2 on its own site | IntelliGRC claims ISO 27001 on its own site | IntelliGRC does not claim ISO 42001 on its own site | IntelliGRC does not claim GDPR on its own site | IntelliGRC claims HIPAA on its own site | IntelliGRC does not claim PCI DSS on its own site | IntelliGRC claims NIST CSF / 800-53 on its own site | IntelliGRC does not claim FedRAMP on its own site | IntelliGRC claims CMMC on its own site | IntelliGRC does not claim EU AI Act on its own site | IntelliGRC does not claim DORA on its own site | IntelliGRC does not claim NIS2 on its own site |
| InthPrivacy and data governance | Inth does not claim SOC 2 on its own site | Inth does not claim ISO 27001 on its own site | Inth does not claim ISO 42001 on its own site | Inth mentions GDPR, but not as a coverage claim | Inth does not claim HIPAA on its own site | Inth does not claim PCI DSS on its own site | Inth does not claim NIST CSF / 800-53 on its own site | Inth does not claim FedRAMP on its own site | Inth does not claim CMMC on its own site | Inth does not claim EU AI Act on its own site | Inth does not claim DORA on its own site | Inth does not claim NIS2 on its own site |
| InvopopTax and e-invoicing | Invopop does not claim SOC 2 on its own site | Invopop mentions ISO 27001, but not as a coverage claim | Invopop does not claim ISO 42001 on its own site | Invopop mentions GDPR, but not as a coverage claim | Invopop does not claim HIPAA on its own site | Invopop does not claim PCI DSS on its own site | Invopop does not claim NIST CSF / 800-53 on its own site | Invopop does not claim FedRAMP on its own site | Invopop does not claim CMMC on its own site | Invopop does not claim EU AI Act on its own site | Invopop does not claim DORA on its own site | Invopop does not claim NIS2 on its own site |
| IridiusAI governance | Iridius was not checked for SOC 2 | Iridius was not checked for ISO 27001 | Iridius was not checked for ISO 42001 | Iridius was not checked for GDPR | Iridius was not checked for HIPAA | Iridius was not checked for PCI DSS | Iridius was not checked for NIST CSF / 800-53 | Iridius was not checked for FedRAMP | Iridius was not checked for CMMC | Iridius was not checked for EU AI Act | Iridius was not checked for DORA | Iridius was not checked for NIS2 |
| ISMS.onlineSOC 2 and ISO 27001 automation | ISMS.online claims SOC 2 on its own site | ISMS.online claims ISO 27001 on its own site | ISMS.online claims ISO 42001 on its own site | ISMS.online claims GDPR on its own site | ISMS.online does not claim HIPAA on its own site | ISMS.online does not claim PCI DSS on its own site | ISMS.online does not claim NIST CSF / 800-53 on its own site | ISMS.online does not claim FedRAMP on its own site | ISMS.online does not claim CMMC on its own site | ISMS.online does not claim EU AI Act on its own site | ISMS.online claims DORA on its own site | ISMS.online claims NIS2 on its own site |
| Isora GRCEnterprise GRC platform | Isora GRC does not claim SOC 2 on its own site | Isora GRC claims ISO 27001 on its own site | Isora GRC does not claim ISO 42001 on its own site | Isora GRC does not claim GDPR on its own site | Isora GRC claims HIPAA on its own site | Isora GRC claims PCI DSS on its own site | Isora GRC claims NIST CSF / 800-53 on its own site | Isora GRC does not claim FedRAMP on its own site | Isora GRC claims CMMC on its own site | Isora GRC does not claim EU AI Act on its own site | Isora GRC does not claim DORA on its own site | Isora GRC does not claim NIS2 on its own site |
| KertosPrivacy and data governance | Kertos claims SOC 2 on its own site | Kertos claims ISO 27001 on its own site | Kertos claims ISO 42001 on its own site | Kertos claims GDPR on its own site | Kertos does not claim HIPAA on its own site | Kertos does not claim PCI DSS on its own site | Kertos does not claim NIST CSF / 800-53 on its own site | Kertos does not claim FedRAMP on its own site | Kertos does not claim CMMC on its own site | Kertos claims EU AI Act on its own site | Kertos does not claim DORA on its own site | Kertos claims NIS2 on its own site |
| KetchPrivacy and data governance | Ketch mentions SOC 2, but not as a coverage claim | Ketch mentions ISO 27001, but not as a coverage claim | Ketch does not claim ISO 42001 on its own site | Ketch claims GDPR on its own site | Ketch does not claim HIPAA on its own site | Ketch does not claim PCI DSS on its own site | Ketch does not claim NIST CSF / 800-53 on its own site | Ketch does not claim FedRAMP on its own site | Ketch does not claim CMMC on its own site | Ketch mentions EU AI Act, but not as a coverage claim | Ketch does not claim DORA on its own site | Ketch does not claim NIS2 on its own site |
| KetryxHealthcare compliance | Ketryx does not claim SOC 2 on its own site | Ketryx does not claim ISO 27001 on its own site | Ketryx does not claim ISO 42001 on its own site | Ketryx does not claim GDPR on its own site | Ketryx does not claim HIPAA on its own site | Ketryx does not claim PCI DSS on its own site | Ketryx does not claim NIST CSF / 800-53 on its own site | Ketryx does not claim FedRAMP on its own site | Ketryx mentions CMMC, but not as a coverage claim | Ketryx claims EU AI Act on its own site | Ketryx does not claim DORA on its own site | Ketryx does not claim NIS2 on its own site |
| KlaaySOC 2 and ISO 27001 automation | Klaay claims SOC 2 on its own site | Klaay does not claim ISO 27001 on its own site | Klaay does not claim ISO 42001 on its own site | Klaay does not claim GDPR on its own site | Klaay does not claim HIPAA on its own site | Klaay does not claim PCI DSS on its own site | Klaay does not claim NIST CSF / 800-53 on its own site | Klaay does not claim FedRAMP on its own site | Klaay does not claim CMMC on its own site | Klaay does not claim EU AI Act on its own site | Klaay does not claim DORA on its own site | Klaay does not claim NIS2 on its own site |
| KlaimeeAI governance | Klaimee does not claim SOC 2 on its own site | Klaimee does not claim ISO 27001 on its own site | Klaimee does not claim ISO 42001 on its own site | Klaimee does not claim GDPR on its own site | Klaimee does not claim HIPAA on its own site | Klaimee does not claim PCI DSS on its own site | Klaimee does not claim NIST CSF / 800-53 on its own site | Klaimee does not claim FedRAMP on its own site | Klaimee does not claim CMMC on its own site | Klaimee does not claim EU AI Act on its own site | Klaimee does not claim DORA on its own site | Klaimee does not claim NIS2 on its own site |
| KnowBe4Compliance training | KnowBe4 does not claim SOC 2 on its own site | KnowBe4 does not claim ISO 27001 on its own site | KnowBe4 does not claim ISO 42001 on its own site | KnowBe4 claims GDPR on its own site | KnowBe4 claims HIPAA on its own site | KnowBe4 claims PCI DSS on its own site | KnowBe4 does not claim NIST CSF / 800-53 on its own site | KnowBe4 does not claim FedRAMP on its own site | KnowBe4 does not claim CMMC on its own site | KnowBe4 does not claim EU AI Act on its own site | KnowBe4 does not claim DORA on its own site | KnowBe4 does not claim NIS2 on its own site |
| Kollate-itThird-party risk | Kollate-it was not checked for SOC 2 | Kollate-it was not checked for ISO 27001 | Kollate-it was not checked for ISO 42001 | Kollate-it was not checked for GDPR | Kollate-it was not checked for HIPAA | Kollate-it was not checked for PCI DSS | Kollate-it was not checked for NIST CSF / 800-53 | Kollate-it was not checked for FedRAMP | Kollate-it was not checked for CMMC | Kollate-it was not checked for EU AI Act | Kollate-it was not checked for DORA | Kollate-it was not checked for NIS2 |
| LemaThird-party risk | Lema does not claim SOC 2 on its own site | Lema does not claim ISO 27001 on its own site | Lema does not claim ISO 42001 on its own site | Lema does not claim GDPR on its own site | Lema does not claim HIPAA on its own site | Lema does not claim PCI DSS on its own site | Lema does not claim NIST CSF / 800-53 on its own site | Lema does not claim FedRAMP on its own site | Lema does not claim CMMC on its own site | Lema does not claim EU AI Act on its own site | Lema does not claim DORA on its own site | Lema does not claim NIS2 on its own site |
| LogicGateEnterprise GRC platform | LogicGate claims SOC 2 on its own site | LogicGate claims ISO 27001 on its own site | LogicGate does not claim ISO 42001 on its own site | LogicGate claims GDPR on its own site | LogicGate claims HIPAA on its own site | LogicGate claims PCI DSS on its own site | LogicGate claims NIST CSF / 800-53 on its own site | LogicGate does not claim FedRAMP on its own site | LogicGate claims CMMC on its own site | LogicGate does not claim EU AI Act on its own site | LogicGate mentions DORA, but not as a coverage claim | LogicGate does not claim NIS2 on its own site |
| LogicManagerEnterprise GRC platform | LogicManager claims SOC 2 on its own site | LogicManager claims ISO 27001 on its own site | LogicManager does not claim ISO 42001 on its own site | LogicManager claims GDPR on its own site | LogicManager claims HIPAA on its own site | LogicManager claims PCI DSS on its own site | LogicManager claims NIST CSF / 800-53 on its own site | LogicManager does not claim FedRAMP on its own site | LogicManager does not claim CMMC on its own site | LogicManager does not claim EU AI Act on its own site | LogicManager does not claim DORA on its own site | LogicManager does not claim NIS2 on its own site |
| LogosGuardPrivacy and data governance | LogosGuard does not claim SOC 2 on its own site | LogosGuard does not claim ISO 27001 on its own site | LogosGuard mentions ISO 42001, but not as a coverage claim | LogosGuard does not claim GDPR on its own site | LogosGuard claims HIPAA on its own site | LogosGuard does not claim PCI DSS on its own site | LogosGuard does not claim NIST CSF / 800-53 on its own site | LogosGuard does not claim FedRAMP on its own site | LogosGuard does not claim CMMC on its own site | LogosGuard does not claim EU AI Act on its own site | LogosGuard does not claim DORA on its own site | LogosGuard does not claim NIS2 on its own site |
| LokkerPrivacy and data governance | Lokker does not claim SOC 2 on its own site | Lokker does not claim ISO 27001 on its own site | Lokker does not claim ISO 42001 on its own site | Lokker claims GDPR on its own site | Lokker claims HIPAA on its own site | Lokker does not claim PCI DSS on its own site | Lokker does not claim NIST CSF / 800-53 on its own site | Lokker does not claim FedRAMP on its own site | Lokker does not claim CMMC on its own site | Lokker does not claim EU AI Act on its own site | Lokker does not claim DORA on its own site | Lokker does not claim NIS2 on its own site |
| LuthorIndustry-specific | Luthor mentions SOC 2, but not as a coverage claim | Luthor does not claim ISO 27001 on its own site | Luthor does not claim ISO 42001 on its own site | Luthor mentions GDPR, but not as a coverage claim | Luthor mentions HIPAA, but not as a coverage claim | Luthor mentions PCI DSS, but not as a coverage claim | Luthor does not claim NIST CSF / 800-53 on its own site | Luthor does not claim FedRAMP on its own site | Luthor does not claim CMMC on its own site | Luthor does not claim EU AI Act on its own site | Luthor does not claim DORA on its own site | Luthor does not claim NIS2 on its own site |
| MedStackHealthcare compliance | MedStack claims SOC 2 on its own site | MedStack claims ISO 27001 on its own site | MedStack does not claim ISO 42001 on its own site | MedStack claims GDPR on its own site | MedStack claims HIPAA on its own site | MedStack does not claim PCI DSS on its own site | MedStack does not claim NIST CSF / 800-53 on its own site | MedStack does not claim FedRAMP on its own site | MedStack does not claim CMMC on its own site | MedStack does not claim EU AI Act on its own site | MedStack does not claim DORA on its own site | MedStack does not claim NIS2 on its own site |
| MedTrainerCompliance training | MedTrainer does not claim SOC 2 on its own site | MedTrainer does not claim ISO 27001 on its own site | MedTrainer does not claim ISO 42001 on its own site | MedTrainer does not claim GDPR on its own site | MedTrainer claims HIPAA on its own site | MedTrainer does not claim PCI DSS on its own site | MedTrainer does not claim NIST CSF / 800-53 on its own site | MedTrainer does not claim FedRAMP on its own site | MedTrainer does not claim CMMC on its own site | MedTrainer does not claim EU AI Act on its own site | MedTrainer does not claim DORA on its own site | MedTrainer does not claim NIS2 on its own site |
| MitratechEnterprise GRC platform | Mitratech does not claim SOC 2 on its own site | Mitratech claims ISO 27001 on its own site | Mitratech does not claim ISO 42001 on its own site | Mitratech claims GDPR on its own site | Mitratech claims HIPAA on its own site | Mitratech does not claim PCI DSS on its own site | Mitratech claims NIST CSF / 800-53 on its own site | Mitratech does not claim FedRAMP on its own site | Mitratech does not claim CMMC on its own site | Mitratech claims EU AI Act on its own site | Mitratech does not claim DORA on its own site | Mitratech does not claim NIS2 on its own site |
| Modicus PrimeHealthcare compliance | Modicus Prime was not checked for SOC 2 | Modicus Prime was not checked for ISO 27001 | Modicus Prime was not checked for ISO 42001 | Modicus Prime was not checked for GDPR | Modicus Prime was not checked for HIPAA | Modicus Prime was not checked for PCI DSS | Modicus Prime was not checked for NIST CSF / 800-53 | Modicus Prime was not checked for FedRAMP | Modicus Prime was not checked for CMMC | Modicus Prime was not checked for EU AI Act | Modicus Prime was not checked for DORA | Modicus Prime was not checked for NIS2 |
| ModulosAI governance | Modulos mentions SOC 2, but not as a coverage claim | Modulos claims ISO 27001 on its own site | Modulos claims ISO 42001 on its own site | Modulos claims GDPR on its own site | Modulos does not claim HIPAA on its own site | Modulos does not claim PCI DSS on its own site | Modulos mentions NIST CSF / 800-53, but not as a coverage claim | Modulos does not claim FedRAMP on its own site | Modulos does not claim CMMC on its own site | Modulos claims EU AI Act on its own site | Modulos claims DORA on its own site | Modulos claims NIS2 on its own site |
| NaqSOC 2 and ISO 27001 automation | Naq does not claim SOC 2 on its own site | Naq claims ISO 27001 on its own site | Naq does not claim ISO 42001 on its own site | Naq claims GDPR on its own site | Naq does not claim HIPAA on its own site | Naq does not claim PCI DSS on its own site | Naq does not claim NIST CSF / 800-53 on its own site | Naq does not claim FedRAMP on its own site | Naq does not claim CMMC on its own site | Naq does not claim EU AI Act on its own site | Naq mentions DORA, but not as a coverage claim | Naq does not claim NIS2 on its own site |
| NcontractsIndustry-specific | Ncontracts does not claim SOC 2 on its own site | Ncontracts does not claim ISO 27001 on its own site | Ncontracts does not claim ISO 42001 on its own site | Ncontracts does not claim GDPR on its own site | Ncontracts does not claim HIPAA on its own site | Ncontracts does not claim PCI DSS on its own site | Ncontracts claims NIST CSF / 800-53 on its own site | Ncontracts does not claim FedRAMP on its own site | Ncontracts does not claim CMMC on its own site | Ncontracts does not claim EU AI Act on its own site | Ncontracts does not claim DORA on its own site | Ncontracts does not claim NIS2 on its own site |
| Norm AIAI governance | Norm AI does not claim SOC 2 on its own site | Norm AI does not claim ISO 27001 on its own site | Norm AI does not claim ISO 42001 on its own site | Norm AI does not claim GDPR on its own site | Norm AI does not claim HIPAA on its own site | Norm AI does not claim PCI DSS on its own site | Norm AI does not claim NIST CSF / 800-53 on its own site | Norm AI does not claim FedRAMP on its own site | Norm AI does not claim CMMC on its own site | Norm AI does not claim EU AI Act on its own site | Norm AI does not claim DORA on its own site | Norm AI does not claim NIS2 on its own site |
| NumeralTax and e-invoicing | Numeral does not claim SOC 2 on its own site | Numeral does not claim ISO 27001 on its own site | Numeral does not claim ISO 42001 on its own site | Numeral does not claim GDPR on its own site | Numeral does not claim HIPAA on its own site | Numeral does not claim PCI DSS on its own site | Numeral does not claim NIST CSF / 800-53 on its own site | Numeral does not claim FedRAMP on its own site | Numeral does not claim CMMC on its own site | Numeral does not claim EU AI Act on its own site | Numeral does not claim DORA on its own site | Numeral does not claim NIS2 on its own site |
| OneleetSOC 2 and ISO 27001 automation | Oneleet claims SOC 2 on its own site | Oneleet claims ISO 27001 on its own site | Oneleet does not claim ISO 42001 on its own site | Oneleet claims GDPR on its own site | Oneleet claims HIPAA on its own site | Oneleet claims PCI DSS on its own site | Oneleet claims NIST CSF / 800-53 on its own site | Oneleet does not claim FedRAMP on its own site | Oneleet does not claim CMMC on its own site | Oneleet does not claim EU AI Act on its own site | Oneleet claims DORA on its own site | Oneleet does not claim NIS2 on its own site |
| OneTrustEnterprise GRC platform | OneTrust claims SOC 2 on its own site | OneTrust mentions ISO 27001, but not as a coverage claim | OneTrust does not claim ISO 42001 on its own site | OneTrust claims GDPR on its own site | OneTrust claims HIPAA on its own site | OneTrust claims PCI DSS on its own site | OneTrust does not claim NIST CSF / 800-53 on its own site | OneTrust does not claim FedRAMP on its own site | OneTrust claims CMMC on its own site | OneTrust claims EU AI Act on its own site | OneTrust claims DORA on its own site | OneTrust claims NIS2 on its own site |
| OnspringEnterprise GRC platform | Onspring claims SOC 2 on its own site | Onspring claims ISO 27001 on its own site | Onspring does not claim ISO 42001 on its own site | Onspring claims GDPR on its own site | Onspring claims HIPAA on its own site | Onspring mentions PCI DSS, but not as a coverage claim | Onspring claims NIST CSF / 800-53 on its own site | Onspring does not claim FedRAMP on its own site | Onspring claims CMMC on its own site | Onspring does not claim EU AI Act on its own site | Onspring does not claim DORA on its own site | Onspring does not claim NIS2 on its own site |
| Optro (formerly AuditBoard)Enterprise GRC platform | Optro (formerly AuditBoard) claims SOC 2 on its own site | Optro (formerly AuditBoard) claims ISO 27001 on its own site | Optro (formerly AuditBoard) does not claim ISO 42001 on its own site | Optro (formerly AuditBoard) does not claim GDPR on its own site | Optro (formerly AuditBoard) does not claim HIPAA on its own site | Optro (formerly AuditBoard) does not claim PCI DSS on its own site | Optro (formerly AuditBoard) claims NIST CSF / 800-53 on its own site | Optro (formerly AuditBoard) does not claim FedRAMP on its own site | Optro (formerly AuditBoard) does not claim CMMC on its own site | Optro (formerly AuditBoard) does not claim EU AI Act on its own site | Optro (formerly AuditBoard) does not claim DORA on its own site | Optro (formerly AuditBoard) does not claim NIS2 on its own site |
| OrbiqSOC 2 and ISO 27001 automation | Orbiq mentions SOC 2, but not as a coverage claim | Orbiq claims ISO 27001 on its own site | Orbiq does not claim ISO 42001 on its own site | Orbiq claims GDPR on its own site | Orbiq does not claim HIPAA on its own site | Orbiq does not claim PCI DSS on its own site | Orbiq does not claim NIST CSF / 800-53 on its own site | Orbiq does not claim FedRAMP on its own site | Orbiq does not claim CMMC on its own site | Orbiq does not claim EU AI Act on its own site | Orbiq claims DORA on its own site | Orbiq claims NIS2 on its own site |
| OsanoPrivacy and data governance | Osano does not claim SOC 2 on its own site | Osano does not claim ISO 27001 on its own site | Osano does not claim ISO 42001 on its own site | Osano claims GDPR on its own site | Osano does not claim HIPAA on its own site | Osano does not claim PCI DSS on its own site | Osano does not claim NIST CSF / 800-53 on its own site | Osano does not claim FedRAMP on its own site | Osano does not claim CMMC on its own site | Osano does not claim EU AI Act on its own site | Osano does not claim DORA on its own site | Osano does not claim NIS2 on its own site |
| osapiensSupply chain and ESG | osapiens does not claim SOC 2 on its own site | osapiens does not claim ISO 27001 on its own site | osapiens does not claim ISO 42001 on its own site | osapiens does not claim GDPR on its own site | osapiens does not claim HIPAA on its own site | osapiens does not claim PCI DSS on its own site | osapiens does not claim NIST CSF / 800-53 on its own site | osapiens does not claim FedRAMP on its own site | osapiens does not claim CMMC on its own site | osapiens does not claim EU AI Act on its own site | osapiens does not claim DORA on its own site | osapiens claims NIS2 on its own site |
| PanoraysThird-party risk | Panorays does not claim SOC 2 on its own site | Panorays mentions ISO 27001, but not as a coverage claim | Panorays does not claim ISO 42001 on its own site | Panorays claims GDPR on its own site | Panorays does not claim HIPAA on its own site | Panorays claims PCI DSS on its own site | Panorays mentions NIST CSF / 800-53, but not as a coverage claim | Panorays does not claim FedRAMP on its own site | Panorays does not claim CMMC on its own site | Panorays does not claim EU AI Act on its own site | Panorays claims DORA on its own site | Panorays does not claim NIS2 on its own site |
| PathlockEnterprise GRC platform | Pathlock does not claim SOC 2 on its own site | Pathlock does not claim ISO 27001 on its own site | Pathlock does not claim ISO 42001 on its own site | Pathlock claims GDPR on its own site | Pathlock claims HIPAA on its own site | Pathlock claims PCI DSS on its own site | Pathlock does not claim NIST CSF / 800-53 on its own site | Pathlock does not claim FedRAMP on its own site | Pathlock does not claim CMMC on its own site | Pathlock does not claim EU AI Act on its own site | Pathlock does not claim DORA on its own site | Pathlock does not claim NIS2 on its own site |
| Praxis LabsCompliance training | Praxis Labs mentions SOC 2, but not as a coverage claim | Praxis Labs does not claim ISO 27001 on its own site | Praxis Labs does not claim ISO 42001 on its own site | Praxis Labs does not claim GDPR on its own site | Praxis Labs does not claim HIPAA on its own site | Praxis Labs does not claim PCI DSS on its own site | Praxis Labs does not claim NIST CSF / 800-53 on its own site | Praxis Labs does not claim FedRAMP on its own site | Praxis Labs does not claim CMMC on its own site | Praxis Labs does not claim EU AI Act on its own site | Praxis Labs does not claim DORA on its own site | Praxis Labs does not claim NIS2 on its own site |
| ProboSOC 2 and ISO 27001 automation | Probo claims SOC 2 on its own site | Probo claims ISO 27001 on its own site | Probo claims ISO 42001 on its own site | Probo claims GDPR on its own site | Probo claims HIPAA on its own site | Probo does not claim PCI DSS on its own site | Probo does not claim NIST CSF / 800-53 on its own site | Probo does not claim FedRAMP on its own site | Probo does not claim CMMC on its own site | Probo does not claim EU AI Act on its own site | Probo does not claim DORA on its own site | Probo does not claim NIS2 on its own site |
| QadiAI governance | Qadi was not checked for SOC 2 | Qadi was not checked for ISO 27001 | Qadi was not checked for ISO 42001 | Qadi was not checked for GDPR | Qadi was not checked for HIPAA | Qadi was not checked for PCI DSS | Qadi was not checked for NIST CSF / 800-53 | Qadi was not checked for FedRAMP | Qadi was not checked for CMMC | Qadi was not checked for EU AI Act | Qadi was not checked for DORA | Qadi was not checked for NIS2 |
| ReadilyHealthcare compliance | Readily mentions SOC 2, but not as a coverage claim | Readily does not claim ISO 27001 on its own site | Readily mentions ISO 42001, but not as a coverage claim | Readily does not claim GDPR on its own site | Readily mentions HIPAA, but not as a coverage claim | Readily does not claim PCI DSS on its own site | Readily does not claim NIST CSF / 800-53 on its own site | Readily does not claim FedRAMP on its own site | Readily does not claim CMMC on its own site | Readily does not claim EU AI Act on its own site | Readily does not claim DORA on its own site | Readily does not claim NIS2 on its own site |
| RegbaseEnterprise GRC platform | Regbase does not claim SOC 2 on its own site | Regbase does not claim ISO 27001 on its own site | Regbase does not claim ISO 42001 on its own site | Regbase claims GDPR on its own site | Regbase claims HIPAA on its own site | Regbase does not claim PCI DSS on its own site | Regbase does not claim NIST CSF / 800-53 on its own site | Regbase does not claim FedRAMP on its own site | Regbase does not claim CMMC on its own site | Regbase claims EU AI Act on its own site | Regbase does not claim DORA on its own site | Regbase does not claim NIS2 on its own site |
| RegcheqEnterprise GRC platform | Regcheq does not claim SOC 2 on its own site | Regcheq does not claim ISO 27001 on its own site | Regcheq does not claim ISO 42001 on its own site | Regcheq does not claim GDPR on its own site | Regcheq does not claim HIPAA on its own site | Regcheq does not claim PCI DSS on its own site | Regcheq does not claim NIST CSF / 800-53 on its own site | Regcheq does not claim FedRAMP on its own site | Regcheq does not claim CMMC on its own site | Regcheq does not claim EU AI Act on its own site | Regcheq does not claim DORA on its own site | Regcheq does not claim NIS2 on its own site |
| RegScaleEnterprise GRC platform | RegScale claims SOC 2 on its own site | RegScale claims ISO 27001 on its own site | RegScale does not claim ISO 42001 on its own site | RegScale claims GDPR on its own site | RegScale claims HIPAA on its own site | RegScale claims PCI DSS on its own site | RegScale claims NIST CSF / 800-53 on its own site | RegScale claims FedRAMP on its own site | RegScale claims CMMC on its own site | RegScale does not claim EU AI Act on its own site | RegScale does not claim DORA on its own site | RegScale does not claim NIS2 on its own site |
| Relyance AIPrivacy and data governance | Relyance AI does not claim SOC 2 on its own site | Relyance AI does not claim ISO 27001 on its own site | Relyance AI does not claim ISO 42001 on its own site | Relyance AI claims GDPR on its own site | Relyance AI claims HIPAA on its own site | Relyance AI does not claim PCI DSS on its own site | Relyance AI mentions NIST CSF / 800-53, but not as a coverage claim | Relyance AI does not claim FedRAMP on its own site | Relyance AI does not claim CMMC on its own site | Relyance AI claims EU AI Act on its own site | Relyance AI does not claim DORA on its own site | Relyance AI does not claim NIS2 on its own site |
| ResolverEnterprise GRC platform | Resolver claims SOC 2 on its own site | Resolver claims ISO 27001 on its own site | Resolver does not claim ISO 42001 on its own site | Resolver claims GDPR on its own site | Resolver mentions HIPAA, but not as a coverage claim | Resolver claims PCI DSS on its own site | Resolver claims NIST CSF / 800-53 on its own site | Resolver claims FedRAMP on its own site | Resolver claims CMMC on its own site | Resolver does not claim EU AI Act on its own site | Resolver does not claim DORA on its own site | Resolver does not claim NIS2 on its own site |
| RiskSmartEnterprise GRC platform | RiskSmart does not claim SOC 2 on its own site | RiskSmart does not claim ISO 27001 on its own site | RiskSmart does not claim ISO 42001 on its own site | RiskSmart does not claim GDPR on its own site | RiskSmart does not claim HIPAA on its own site | RiskSmart does not claim PCI DSS on its own site | RiskSmart does not claim NIST CSF / 800-53 on its own site | RiskSmart does not claim FedRAMP on its own site | RiskSmart does not claim CMMC on its own site | RiskSmart does not claim EU AI Act on its own site | RiskSmart does not claim DORA on its own site | RiskSmart does not claim NIS2 on its own site |
| RitivelHealthcare compliance | Ritivel was not checked for SOC 2 | Ritivel was not checked for ISO 27001 | Ritivel was not checked for ISO 42001 | Ritivel was not checked for GDPR | Ritivel was not checked for HIPAA | Ritivel was not checked for PCI DSS | Ritivel was not checked for NIST CSF / 800-53 | Ritivel was not checked for FedRAMP | Ritivel was not checked for CMMC | Ritivel was not checked for EU AI Act | Ritivel was not checked for DORA | Ritivel was not checked for NIS2 |
| RulebaseSOC 2 and ISO 27001 automation | Rulebase mentions SOC 2, but not as a coverage claim | Rulebase does not claim ISO 27001 on its own site | Rulebase does not claim ISO 42001 on its own site | Rulebase mentions GDPR, but not as a coverage claim | Rulebase does not claim HIPAA on its own site | Rulebase mentions PCI DSS, but not as a coverage claim | Rulebase does not claim NIST CSF / 800-53 on its own site | Rulebase does not claim FedRAMP on its own site | Rulebase does not claim CMMC on its own site | Rulebase does not claim EU AI Act on its own site | Rulebase does not claim DORA on its own site | Rulebase does not claim NIS2 on its own site |
| SafeBaseQuestionnaires and trust centers | SafeBase was not checked for SOC 2 | SafeBase was not checked for ISO 27001 | SafeBase was not checked for ISO 42001 | SafeBase was not checked for GDPR | SafeBase was not checked for HIPAA | SafeBase was not checked for PCI DSS | SafeBase was not checked for NIST CSF / 800-53 | SafeBase was not checked for FedRAMP | SafeBase was not checked for CMMC | SafeBase was not checked for EU AI Act | SafeBase was not checked for DORA | SafeBase was not checked for NIS2 |
| SafetyKitIndustry-specific | SafetyKit was not checked for SOC 2 | SafetyKit was not checked for ISO 27001 | SafetyKit was not checked for ISO 42001 | SafetyKit was not checked for GDPR | SafetyKit was not checked for HIPAA | SafetyKit was not checked for PCI DSS | SafetyKit was not checked for NIST CSF / 800-53 | SafetyKit was not checked for FedRAMP | SafetyKit was not checked for CMMC | SafetyKit was not checked for EU AI Act | SafetyKit was not checked for DORA | SafetyKit was not checked for NIS2 |
| Scrut AutomationSOC 2 and ISO 27001 automation | Scrut Automation claims SOC 2 on its own site | Scrut Automation claims ISO 27001 on its own site | Scrut Automation does not claim ISO 42001 on its own site | Scrut Automation claims GDPR on its own site | Scrut Automation claims HIPAA on its own site | Scrut Automation claims PCI DSS on its own site | Scrut Automation mentions NIST CSF / 800-53, but not as a coverage claim | Scrut Automation does not claim FedRAMP on its own site | Scrut Automation does not claim CMMC on its own site | Scrut Automation does not claim EU AI Act on its own site | Scrut Automation does not claim DORA on its own site | Scrut Automation does not claim NIS2 on its own site |
| ScytaleSOC 2 and ISO 27001 automation | Scytale claims SOC 2 on its own site | Scytale claims ISO 27001 on its own site | Scytale claims ISO 42001 on its own site | Scytale claims GDPR on its own site | Scytale claims HIPAA on its own site | Scytale claims PCI DSS on its own site | Scytale does not claim NIST CSF / 800-53 on its own site | Scytale does not claim FedRAMP on its own site | Scytale claims CMMC on its own site | Scytale does not claim EU AI Act on its own site | Scytale does not claim DORA on its own site | Scytale does not claim NIS2 on its own site |
| SecfixSOC 2 and ISO 27001 automation | Secfix claims SOC 2 on its own site | Secfix claims ISO 27001 on its own site | Secfix claims ISO 42001 on its own site | Secfix claims GDPR on its own site | Secfix does not claim HIPAA on its own site | Secfix does not claim PCI DSS on its own site | Secfix does not claim NIST CSF / 800-53 on its own site | Secfix does not claim FedRAMP on its own site | Secfix does not claim CMMC on its own site | Secfix does not claim EU AI Act on its own site | Secfix claims DORA on its own site | Secfix claims NIS2 on its own site |
| SecureframeSOC 2 and ISO 27001 automation | Secureframe claims SOC 2 on its own site | Secureframe claims ISO 27001 on its own site | Secureframe claims ISO 42001 on its own site | Secureframe claims GDPR on its own site | Secureframe claims HIPAA on its own site | Secureframe claims PCI DSS on its own site | Secureframe claims NIST CSF / 800-53 on its own site | Secureframe claims FedRAMP on its own site | Secureframe claims CMMC on its own site | Secureframe claims EU AI Act on its own site | Secureframe claims DORA on its own site | Secureframe claims NIS2 on its own site |
| SecuritiPrivacy and data governance | Securiti does not claim SOC 2 on its own site | Securiti does not claim ISO 27001 on its own site | Securiti does not claim ISO 42001 on its own site | Securiti claims GDPR on its own site | Securiti does not claim HIPAA on its own site | Securiti mentions PCI DSS, but not as a coverage claim | Securiti mentions NIST CSF / 800-53, but not as a coverage claim | Securiti does not claim FedRAMP on its own site | Securiti does not claim CMMC on its own site | Securiti claims EU AI Act on its own site | Securiti does not claim DORA on its own site | Securiti does not claim NIS2 on its own site |
| Snap ComplianceEnterprise GRC platform | Snap Compliance does not claim SOC 2 on its own site | Snap Compliance mentions ISO 27001, but not as a coverage claim | Snap Compliance does not claim ISO 42001 on its own site | Snap Compliance does not claim GDPR on its own site | Snap Compliance does not claim HIPAA on its own site | Snap Compliance does not claim PCI DSS on its own site | Snap Compliance does not claim NIST CSF / 800-53 on its own site | Snap Compliance does not claim FedRAMP on its own site | Snap Compliance does not claim CMMC on its own site | Snap Compliance does not claim EU AI Act on its own site | Snap Compliance does not claim DORA on its own site | Snap Compliance does not claim NIS2 on its own site |
| SovosTax and e-invoicing | Sovos does not claim SOC 2 on its own site | Sovos does not claim ISO 27001 on its own site | Sovos does not claim ISO 42001 on its own site | Sovos does not claim GDPR on its own site | Sovos does not claim HIPAA on its own site | Sovos does not claim PCI DSS on its own site | Sovos does not claim NIST CSF / 800-53 on its own site | Sovos does not claim FedRAMP on its own site | Sovos does not claim CMMC on its own site | Sovos does not claim EU AI Act on its own site | Sovos does not claim DORA on its own site | Sovos does not claim NIS2 on its own site |
| SprintoSOC 2 and ISO 27001 automation | Sprinto claims SOC 2 on its own site | Sprinto claims ISO 27001 on its own site | Sprinto mentions ISO 42001, but not as a coverage claim | Sprinto claims GDPR on its own site | Sprinto claims HIPAA on its own site | Sprinto claims PCI DSS on its own site | Sprinto does not claim NIST CSF / 800-53 on its own site | Sprinto does not claim FedRAMP on its own site | Sprinto does not claim CMMC on its own site | Sprinto does not claim EU AI Act on its own site | Sprinto does not claim DORA on its own site | Sprinto does not claim NIS2 on its own site |
| StandardFusionEnterprise GRC platform | StandardFusion was not checked for SOC 2 | StandardFusion was not checked for ISO 27001 | StandardFusion was not checked for ISO 42001 | StandardFusion was not checked for GDPR | StandardFusion was not checked for HIPAA | StandardFusion was not checked for PCI DSS | StandardFusion was not checked for NIST CSF / 800-53 | StandardFusion was not checked for FedRAMP | StandardFusion was not checked for CMMC | StandardFusion was not checked for EU AI Act | StandardFusion was not checked for DORA | StandardFusion was not checked for NIS2 |
| SteelEyeFinancial services compliance | SteelEye does not claim SOC 2 on its own site | SteelEye does not claim ISO 27001 on its own site | SteelEye does not claim ISO 42001 on its own site | SteelEye does not claim GDPR on its own site | SteelEye does not claim HIPAA on its own site | SteelEye does not claim PCI DSS on its own site | SteelEye does not claim NIST CSF / 800-53 on its own site | SteelEye does not claim FedRAMP on its own site | SteelEye does not claim CMMC on its own site | SteelEye does not claim EU AI Act on its own site | SteelEye does not claim DORA on its own site | SteelEye does not claim NIS2 on its own site |
| StracPrivacy and data governance | Strac claims SOC 2 on its own site | Strac claims ISO 27001 on its own site | Strac does not claim ISO 42001 on its own site | Strac does not claim GDPR on its own site | Strac claims HIPAA on its own site | Strac claims PCI DSS on its own site | Strac does not claim NIST CSF / 800-53 on its own site | Strac does not claim FedRAMP on its own site | Strac does not claim CMMC on its own site | Strac does not claim EU AI Act on its own site | Strac does not claim DORA on its own site | Strac does not claim NIS2 on its own site |
| Strike GraphSOC 2 and ISO 27001 automation | Strike Graph claims SOC 2 on its own site | Strike Graph claims ISO 27001 on its own site | Strike Graph claims ISO 42001 on its own site | Strike Graph claims GDPR on its own site | Strike Graph claims HIPAA on its own site | Strike Graph claims PCI DSS on its own site | Strike Graph claims NIST CSF / 800-53 on its own site | Strike Graph claims FedRAMP on its own site | Strike Graph claims CMMC on its own site | Strike Graph mentions EU AI Act, but not as a coverage claim | Strike Graph claims DORA on its own site | Strike Graph claims NIS2 on its own site |
| TentacleEnterprise GRC platform | Tentacle was not checked for SOC 2 | Tentacle was not checked for ISO 27001 | Tentacle was not checked for ISO 42001 | Tentacle was not checked for GDPR | Tentacle was not checked for HIPAA | Tentacle was not checked for PCI DSS | Tentacle was not checked for NIST CSF / 800-53 | Tentacle was not checked for FedRAMP | Tentacle was not checked for CMMC | Tentacle was not checked for EU AI Act | Tentacle was not checked for DORA | Tentacle was not checked for NIS2 |
| ThoropassSOC 2 and ISO 27001 automation | Thoropass claims SOC 2 on its own site | Thoropass claims ISO 27001 on its own site | Thoropass does not claim ISO 42001 on its own site | Thoropass claims GDPR on its own site | Thoropass claims HIPAA on its own site | Thoropass claims PCI DSS on its own site | Thoropass claims NIST CSF / 800-53 on its own site | Thoropass does not claim FedRAMP on its own site | Thoropass claims CMMC on its own site | Thoropass does not claim EU AI Act on its own site | Thoropass does not claim DORA on its own site | Thoropass claims NIS2 on its own site |
| TranscendPrivacy and data governance | Transcend does not claim SOC 2 on its own site | Transcend does not claim ISO 27001 on its own site | Transcend does not claim ISO 42001 on its own site | Transcend claims GDPR on its own site | Transcend mentions HIPAA, but not as a coverage claim | Transcend does not claim PCI DSS on its own site | Transcend does not claim NIST CSF / 800-53 on its own site | Transcend does not claim FedRAMP on its own site | Transcend does not claim CMMC on its own site | Transcend does not claim EU AI Act on its own site | Transcend does not claim DORA on its own site | Transcend does not claim NIS2 on its own site |
| TravaSupply chain and ESG | Trava claims SOC 2 on its own site | Trava claims ISO 27001 on its own site | Trava claims ISO 42001 on its own site | Trava claims GDPR on its own site | Trava claims HIPAA on its own site | Trava does not claim PCI DSS on its own site | Trava claims NIST CSF / 800-53 on its own site | Trava claims FedRAMP on its own site | Trava does not claim CMMC on its own site | Trava does not claim EU AI Act on its own site | Trava does not claim DORA on its own site | Trava does not claim NIS2 on its own site |
| TrioSOC 2 and ISO 27001 automation | Trio claims SOC 2 on its own site | Trio mentions ISO 27001, but not as a coverage claim | Trio does not claim ISO 42001 on its own site | Trio claims GDPR on its own site | Trio claims HIPAA on its own site | Trio claims PCI DSS on its own site | Trio does not claim NIST CSF / 800-53 on its own site | Trio does not claim FedRAMP on its own site | Trio does not claim CMMC on its own site | Trio does not claim EU AI Act on its own site | Trio does not claim DORA on its own site | Trio does not claim NIS2 on its own site |
| TrustCloudEnterprise GRC platform | TrustCloud claims SOC 2 on its own site | TrustCloud claims ISO 27001 on its own site | TrustCloud claims ISO 42001 on its own site | TrustCloud claims GDPR on its own site | TrustCloud claims HIPAA on its own site | TrustCloud does not claim PCI DSS on its own site | TrustCloud does not claim NIST CSF / 800-53 on its own site | TrustCloud does not claim FedRAMP on its own site | TrustCloud claims CMMC on its own site | TrustCloud does not claim EU AI Act on its own site | TrustCloud does not claim DORA on its own site | TrustCloud does not claim NIS2 on its own site |
| TrustibleAI governance | Trustible does not claim SOC 2 on its own site | Trustible does not claim ISO 27001 on its own site | Trustible claims ISO 42001 on its own site | Trustible does not claim GDPR on its own site | Trustible does not claim HIPAA on its own site | Trustible does not claim PCI DSS on its own site | Trustible mentions NIST CSF / 800-53, but not as a coverage claim | Trustible does not claim FedRAMP on its own site | Trustible does not claim CMMC on its own site | Trustible claims EU AI Act on its own site | Trustible does not claim DORA on its own site | Trustible does not claim NIS2 on its own site |
| Unit21Financial services compliance | Unit21 mentions SOC 2, but not as a coverage claim | Unit21 does not claim ISO 27001 on its own site | Unit21 does not claim ISO 42001 on its own site | Unit21 mentions GDPR, but not as a coverage claim | Unit21 does not claim HIPAA on its own site | Unit21 does not claim PCI DSS on its own site | Unit21 does not claim NIST CSF / 800-53 on its own site | Unit21 does not claim FedRAMP on its own site | Unit21 does not claim CMMC on its own site | Unit21 does not claim EU AI Act on its own site | Unit21 does not claim DORA on its own site | Unit21 does not claim NIS2 on its own site |
| UpGuardThird-party risk | UpGuard mentions SOC 2, but not as a coverage claim | UpGuard claims ISO 27001 on its own site | UpGuard does not claim ISO 42001 on its own site | UpGuard claims GDPR on its own site | UpGuard claims HIPAA on its own site | UpGuard claims PCI DSS on its own site | UpGuard claims NIST CSF / 800-53 on its own site | UpGuard does not claim FedRAMP on its own site | UpGuard does not claim CMMC on its own site | UpGuard does not claim EU AI Act on its own site | UpGuard claims DORA on its own site | UpGuard does not claim NIS2 on its own site |
| VantaSOC 2 and ISO 27001 automation | Vanta claims SOC 2 on its own site | Vanta claims ISO 27001 on its own site | Vanta claims ISO 42001 on its own site | Vanta claims GDPR on its own site | Vanta claims HIPAA on its own site | Vanta claims PCI DSS on its own site | Vanta claims NIST CSF / 800-53 on its own site | Vanta claims FedRAMP on its own site | Vanta claims CMMC on its own site | Vanta claims EU AI Act on its own site | Vanta claims DORA on its own site | Vanta claims NIS2 on its own site |
| VendictQuestionnaires and trust centers | Vendict claims SOC 2 on its own site | Vendict claims ISO 27001 on its own site | Vendict does not claim ISO 42001 on its own site | Vendict mentions GDPR, but not as a coverage claim | Vendict claims HIPAA on its own site | Vendict does not claim PCI DSS on its own site | Vendict does not claim NIST CSF / 800-53 on its own site | Vendict does not claim FedRAMP on its own site | Vendict does not claim CMMC on its own site | Vendict does not claim EU AI Act on its own site | Vendict mentions DORA, but not as a coverage claim | Vendict does not claim NIS2 on its own site |
| WhisticQuestionnaires and trust centers | Whistic mentions SOC 2, but not as a coverage claim | Whistic mentions ISO 27001, but not as a coverage claim | Whistic mentions ISO 42001, but not as a coverage claim | Whistic mentions GDPR, but not as a coverage claim | Whistic does not claim HIPAA on its own site | Whistic does not claim PCI DSS on its own site | Whistic does not claim NIST CSF / 800-53 on its own site | Whistic does not claim FedRAMP on its own site | Whistic does not claim CMMC on its own site | Whistic does not claim EU AI Act on its own site | Whistic does not claim DORA on its own site | Whistic does not claim NIS2 on its own site |
| XorabyteSOC 2 and ISO 27001 automation | Xorabyte claims SOC 2 on its own site | Xorabyte claims ISO 27001 on its own site | Xorabyte mentions ISO 42001, but not as a coverage claim | Xorabyte mentions GDPR, but not as a coverage claim | Xorabyte claims HIPAA on its own site | Xorabyte claims PCI DSS on its own site | Xorabyte does not claim NIST CSF / 800-53 on its own site | Xorabyte does not claim FedRAMP on its own site | Xorabyte does not claim CMMC on its own site | Xorabyte mentions EU AI Act, but not as a coverage claim | Xorabyte does not claim DORA on its own site | Xorabyte does not claim NIS2 on its own site |
| ZaniaSOC 2 and ISO 27001 automation | Zania claims SOC 2 on its own site | Zania claims ISO 27001 on its own site | Zania claims ISO 42001 on its own site | Zania claims GDPR on its own site | Zania claims HIPAA on its own site | Zania claims PCI DSS on its own site | Zania mentions NIST CSF / 800-53, but not as a coverage claim | Zania does not claim FedRAMP on its own site | Zania does not claim CMMC on its own site | Zania does not claim EU AI Act on its own site | Zania does not claim DORA on its own site | Zania does not claim NIS2 on its own site |
| ZeroDriftAI governance | ZeroDrift mentions SOC 2, but not as a coverage claim | ZeroDrift mentions ISO 27001, but not as a coverage claim | ZeroDrift does not claim ISO 42001 on its own site | ZeroDrift mentions GDPR, but not as a coverage claim | ZeroDrift claims HIPAA on its own site | ZeroDrift does not claim PCI DSS on its own site | ZeroDrift does not claim NIST CSF / 800-53 on its own site | ZeroDrift does not claim FedRAMP on its own site | ZeroDrift does not claim CMMC on its own site | ZeroDrift does not claim EU AI Act on its own site | ZeroDrift does not claim DORA on its own site | ZeroDrift does not claim NIS2 on its own site |
Questions
- Does a blank cell mean the platform cannot handle that framework?
- No. It means the vendor does not claim this on its own site. Some platforms support a framework through a generic custom-framework feature and never name it in marketing; others name only the frameworks they sell hardest. A blank is a prompt to ask, not a finding about the product.
- Is a filled cell a certification?
- No. It records that the vendor states its product covers that framework. It is not an audit, not an assessment, and not a check that the coverage is any good. A vendor's own certifications, such as holding a SOC 2 Type II report itself, are a different claim and are not recorded here at all.
- Why do some vendors claim none of the twelve?
- Because plenty of real compliance work sits outside these twelve frameworks: the EU Cyber Resilience Act, CSRD, e-invoicing mandates, prevailing-wage rules, AML and KYC obligations. A vendor with an empty row was read and genuinely claims none of these twelve, which is different from not having been read at all.
- Why are there no per-framework pages?
- Because the identity slice of most of these frameworks is already published on CIAM Compass, and duplicating it here would split one subject across two properties for no reader's benefit.
Each row was read from one page on the vendor's own site; that page and its date are on the vendor's profile. Vendors change their marketing without notice, so confirm anything you are about to act on. How this is built · Disclaimer