Frameworks
Get ready for the frameworks your customers ask for.
We support all major frameworks, including CMMC. We get you ready and manage your audit program. An independent auditor performs the audit.
One control, many frameworks
ExampleLog access to systems and review the logs
Supports
- SOC 2
- ISO 27001
- HIPAA
- PCI DSS
- NIST CSF
- CMMC
Supported frameworks
Ten frameworks, one managed program.
Pick one for the details of what readiness involves.
- SOC 2Trust services criteria
- ISO 27001Information security
- ISO 42001AI management
- HIPAAHealthcare privacy
- PCI DSSPayment security
- NIST CSFCybersecurity framework
- NIST AI RMFAI risk management
- HITRUST CSFHealthcare assurance
- GDPREU data protection
- CMMCDefense supply chain
Plus others on request. Badges are illustrative emblems, not official seals. All of it runs as one managed program, with one control library mapped across your frameworks (see the platform).
Who does what
We get you ready. An independent auditor decides.
Vectra View does not issue any certification or report, and naming a framework here does not mean we hold it.
Vectra View
Readiness and program management. VectraIQ drafts, scans and tracks. Your expert team reviews, prioritizes and guides you to close gaps.
Independent auditor
Examines your controls and decides the outcome. We do not perform the audit or issue the certification, and we do not influence the result.
Your team
Owns the decisions and makes the changes in your environment, with remediation guidance from your expert team.
Framework by framework
What readiness looks like for each one.
Your cyber expert confirms scope and depth at kickoff.
SOC 2Trust services criteria
- Who it is for
- Service providers whose customers ask for assurance over how their data is secured.
- The independent party
- An independent auditor examines your controls and issues the SOC 2 report.
ISO 27001Information security
- Who it is for
- Organizations that want a formally certified information security management system.
- The independent party
- An independent certification body audits your management system and decides on certification.
ISO 42001AI management
- Who it is for
- Organizations that build or use AI and want a structured AI management system.
- The independent party
- An independent certification body audits the management system and decides on certification.
HIPAAHealthcare privacy
- Who it is for
- Healthcare organizations and the vendors that handle their patient data.
- The independent party
- HIPAA has no certification. A regulator can audit, and some customers ask for an independent assessment.
PCI DSSPayment security
- Who it is for
- Organizations that store, process or transmit payment card data.
- The independent party
- Depending on your volume and whether you are a merchant or a service provider, a Qualified Security Assessor validates compliance, or you complete a self-assessment.
NIST CSFCybersecurity framework
- Who it is for
- Organizations that want a common, practical structure for managing cybersecurity risk.
- The independent party
- The framework is voluntary and there is no certification. Some customers or insurers ask for an independent review.
NIST AI RMFAI risk management
- Who it is for
- Organizations that build or buy AI systems and need to show how they manage the risk.
- The independent party
- The framework is voluntary and there is no certification.
HITRUST CSFHealthcare assurance
- Who it is for
- Organizations whose customers ask for HITRUST, often in healthcare and related sectors.
- The independent party
- An authorized external assessor performs the assessment, and HITRUST issues the result.
GDPREU data protection
- Who it is for
- Organizations that handle personal data of people in the EU.
- The independent party
- GDPR has no single mandatory certification. Voluntary certification mechanisms exist under Articles 42 and 43, but they do not replace compliance. Supervisory authorities enforce it, and customers may review your controls.
CMMCDefense supply chain
- Who it is for
- Contractors and subcontractors in the defense supply chain.
- The independent party
- Depending on the level in your contract, you self-assess, a certified third-party assessor (C3PAO) assesses you, or, at the highest level, a government assessment team does.
Not sure which framework?
Start with a free look at your risk.
You do not need to choose before you talk to us. A customer, contract or insurer usually names it. If not, a risk check shows your gaps.
Questions, answered.
Does Vectra View issue the certification or report?
No. An independent auditor or certification body performs the audit and issues the result. We get you ready, keep your evidence in order and support you through the audit.
Do you support CMMC?
Yes. We support all major frameworks, including CMMC. Your cyber expert confirms the level and scope you need for your contracts at kickoff.
Do you support FedRAMP?
No. We do not support FedRAMP or similar government programs.
What if our framework is not on the list?
Ask us. We support other frameworks on request, and your cyber expert will tell you plainly what we can and cannot cover.
Will we pass the audit?
Independent auditors decide that, so we cannot promise a result. We get you ready, and if the audit surfaces gaps, your expert team helps you close them.
Tell us which framework you need.
A lead expert will talk through your frameworks and what a managed program would look like.