Inventory the real controls
We start with your systems, data flows, and operating practice. The control library reflects what you actually do, not an aspirational template.
Framework coverage
The standards your buyers ask about. Mapped, not memorized.
Every framework has its own language. Most of them are asking for the same underlying controls. We map once, cross-reference the requirements, and keep the evidence current as your buyers add new acronyms.
The method
A library, not a pile of spreadsheets.
Framework mapping is an architecture problem. We treat it like one.
Map once, cross-reference
Each control is mapped to the frameworks that require it. SOC 2, ISO 27001, HIPAA, PCI DSS, and FedRAMP share more than most teams realize.
Operate continuously
Owners, evidence sources, and review cadence are assigned once. Adding a framework becomes an update, not a new program.
Coverage
The full map.
The frameworks we see most often in enterprise and regulated deals. If yours is missing, ask — it is probably a variation of something here.
SOC 1 System and Organization Controls 1
Controls at a service organization that affect customers’ financial reporting.
Finance teams, enterprise procurement, and auditors.
Readiness → Type I or Type II Explore service
SOC 2 System and Organization Controls 2
Security, availability, processing integrity, confidentiality, and privacy controls.
B2B buyers, security teams, and enterprise procurement.
Readiness → Type I → Type II Explore service
SOC 3 System and Organization Controls 3
A public seal summarizing the results of a SOC 2 examination.
Prospects, marketing, and buyers who need a high-level assurance signal.
Builds on SOC 2 Explore service
ISO 27001 ISO/IEC 27001
A risk-based information security management system, independently certified.
International enterprises, EU customers, and regulated partners.
ISMS → Internal audit → Certification Explore service
ISO 27701 ISO/IEC 27701
A privacy information management extension to an ISO 27001 ISMS.
Privacy teams, EU customers, and data-intensive enterprises.
Extends ISO 27001 Explore service
ISO 42001 ISO/IEC 42001
A management system for responsible AI governance and risk.
AI procurement teams, regulators, and enterprise customers.
AI governance readiness Talk to us
PCI DSS 4.0.1 Payment Card Industry Data Security Standard
Controls protecting cardholder data across the payment environment.
Acquirers, payment processors, merchants, and enterprise customers.
Scope reduction → SAQ or ROC → Continuous compliance Explore service
HIPAA Health Insurance Portability and Accountability Act
Administrative, physical, and technical safeguards for protected health information.
Healthcare providers, payers, and business associates.
Risk analysis → Safeguards → Recurring review Explore service
HITRUST HITRUST CSF
A risk-based healthcare security framework with certification options.
Health systems, payers, and healthcare procurement teams.
Readiness → Validated assessment Talk to us
FedRAMP Federal Risk and Authorization Management Program
A standardized security authorization for cloud services used by federal agencies.
Federal agencies, defense contractors, and government-adjacent buyers.
Readiness → 3PAO assessment → Agency authorization Explore service
GDPR EU General Data Protection Regulation
Lawful processing, accountability, and privacy rights for EU personal data.
EU and UK customers, DPOs, and privacy-conscious enterprises.
Data map → DPIAs → Operating cadence Explore service
UK GDPR United Kingdom General Data Protection Regulation
UK-specific privacy obligations and international transfer requirements.
UK customers, employees, and partners.
Aligns with GDPR program Explore service
NIST CSF 2.0 NIST Cybersecurity Framework 2.0
A risk-management framework for governing, identifying, protecting, detecting, responding, and recovering.
Enterprise security teams, insurers, and boards.
Maturity assessment → Roadmap Talk to us
NIST 800-53 NIST Special Publication 800-53
A catalog of security and privacy controls used across federal and regulated systems.
Federal agencies, FedRAMP assessors, and defense contractors.
Control mapping → Assessment Explore service
EU AI Act European Union Artificial Intelligence Act
Risk management, transparency, and governance obligations for AI systems.
EU customers, AI procurement teams, and regulators.
AI inventory → Risk classification → Governance Talk to us
CCPA / CPRA California Consumer Privacy Act / California Privacy Rights Act
California consumer privacy rights, disclosures, and vendor obligations.
US consumer businesses and privacy teams.
Data map → Disclosures → Request workflow Explore service
Framework questions
Questions, answered.
The details that usually come up before the first call.
Ask a different questionWhich framework should we start with?
Start with the request that is blocking revenue. For most US B2B software companies, that is SOC 2. If you sell internationally, ISO 27001 may be the better first investment. If you handle PHI, card data, or federal data, the framework is usually dictated by the buyer or regulator. We map the actual requirement before recommending a path.
Can one control set really cover multiple frameworks?
Yes, with thoughtful mapping. The underlying controls — access, change management, monitoring, incident response, vendor risk — overlap substantially. Each framework adds specific requirements and language. A canonical library lets you satisfy the overlaps once and handle the deltas explicitly.
Do you replace our auditor, QSA, or certification body?
No. Independent attestations and certifications are issued by independent CPA firms, qualified security assessors, or accredited certification bodies. SES leads readiness, control design, evidence, and coordination, and works alongside your assessor.
How long does framework mapping take?
A focused first mapping usually takes a few working sessions. The larger effort is designing controls and collecting evidence, which is why we sequence the work around your first buyer milestone rather than trying to boil the ocean.
What if a buyer asks for something not on this list?
Send us the questionnaire or requirement. We will map it to your existing controls and tell you whether it is a document request, a gap, or a new framework entirely. You do not need to start a new program every time a buyer uses a different acronym.
Next step
Not sure which framework comes next?
Send us the buyer request, questionnaire, or deal context. We will map it to the shortest defensible path.
We reply within one business day.