One control library, every framework

Map one control once. Satisfy every framework that applies to you

Most companies end up needing more than one certification. Certifyi’s unified control library means the evidence you collect for SOC 2 also counts toward ISO 27001, ISO 42001, HIPAA and GDPR, so the second framework takes weeks, not another year.
Ask which framework you need
How the control library works
Which framework should we start with? If your customers are US enterprises, start with SOC 2. If they are in the EU, UK or APAC, start with ISO 27001. If you ship AI features, add ISO 42001. If you touch health data in the US, HIPAA is mandatory; if you process EU personal data, GDPR applies regardless of where you are based.

Frameworks we implement and certify

US enterprise

SOC 2

The most requested trust report for SaaS companies selling into the US. Type I in 8–12 weeks; Type II after a 3–12 month observation period.

SOC 2 details →

Global

ISO 27001

The international standard for information security management, expected across EU, UK and APAC deals. Certification, not just a report.

ISO 27001 details →

AI systems

ISO 42001

The first international standard for AI management systems, built for teams shipping AI features and preparing for the EU AI Act.

ISO 42001 details →

US health data

HIPAA

Required for any company that creates, stores or transmits protected health information in the US, including their vendors.

HIPAA details →

EU personal data

GDPR

The EU’s data protection regulation. Applies to any company handling EU resident data, wherever the company is based.

GDPR details →

Also covered

EU AI Act, NIST AI RMF, NIS 2, PCI DSS

Mapped in the same control library. Ask about CMMC, Essential Eight, HITRUST and regional financial regulations on a call.

AI risk framework guide →

Reuse, not repeat

How much of your first framework carries over

Typical control overlap when the second framework is added inside Certifyi’s shared library.
Starting fromAddingControls reusedTypical extra time
SOC 2ISO 27001~70–80%4–6 weeks
ISO 27001SOC 2~75–85%3–5 weeks plus observation period for Type II
ISO 27001ISO 42001~60–70%4–6 weeks
SOC 2 or ISO 27001HIPAA~65–75%2–4 weeks
SOC 2 or ISO 27001GDPR~50–60%3–5 weeks
Ranges reflect typical Certifyi engagements. Your overlap depends on scope, data types and existing controls.

Framework questions we hear most

Type I attests that your controls are designed correctly at a point in time. Type II attests that they operated effectively over an observation period, usually three to twelve months. Most enterprise customers ultimately ask for Type II; many accept a Type I plus a Type II in progress.

Only if you develop or deploy AI systems and your customers or regulators ask for AI-specific governance. ISO 42001 shares the management-system structure with ISO 27001, so roughly two thirds of the work is already done.

Often, yes. Many certification bodies run integrated ISO 27001 and ISO 42001 audits, and SOC 2 evidence can be presented from the same control library. Certifyi coordinates the audit calendar so you are not audited twice for the same control.

Audit-ready in 8–12 weeks for SOC 2 Type I or ISO 27001 scope. The certification audit itself is then scheduled with the auditor; ISO certification typically completes within four to eight weeks of the audit.

More frameworks we support

Guide

EU AI Act

Classify your AI systems under the EU AI Act risk tiers and build required controls with Certifyi. Phased deadlines through 2027, start before enforcement hits your tier.

Read more →

Guide

NIST AI RMF

Build a NIST AI Risk Management Framework-aligned program in 8-10 weeks with Certifyi. Maps directly to SOC 2 and ISO 42001 controls you already have.

Read more →

Guide

HITRUST CSF

Get HITRUST CSF certified with Certifyi. Pre-built controls harmonized across HIPAA, ISO 27001, and NIST, mapped to e1, i1, or r2 assessment tiers.

Read more →

Guide

E8

Reach your target Essential Eight maturity level with Certifyi. Pre-built controls for all 8 ACSC mitigation strategies, mapped to Maturity Level 1-3.

Read more →

Guide

PCI DSS

Get PCI DSS v4.0 compliant with Certifyi. Pre-built controls for all 12 requirements, scoped to your merchant level, with weekly expert check-ins.

Read more →

Not sure which framework you need?

Tell us your customers, your data and your deal pipeline. We will tell you exactly which certification unblocks the most revenue first.
Book a readiness call
Start the free self-assessment

Checklists

Compare

Company

Offices

Pulchowk, Lalitpur, Nepal
342 Waterloo Rd, Glenroy VIC 3046, Australia

Email

[email protected]

Copyright © 2026 CERTIFYI. All Rights Reserved by Certifyi AI

Scroll to Top