For In-house compliance and security leads
Before you scope a new certification, find out how much of it your existing evidence already satisfies.
The job: Decide whether a new standard is a quarter of work or a year of it, before committing to either.
Coverage is directional. Holding ISO 27001 covers far more of SOC 2 than the reverse, and a vendor quoting one number for a pair has computed a resemblance rather than judged a transfer.
Find your pairCoverage is never evenly spread. A source standard usually satisfies one part of a target almost completely and barely touches another, and which part is which is what decides the plan.
Open a pairUpload a policy document and get it read against a framework, control by control, with what is covered and what is missing.
Run a gap analysisThis does not watch your systems. If what you need is continuous monitoring and evidence collection, that is a different category of product and we do not compete with it.
An auditor tells you whether you pass the standard in front of them. This tells you how much of a standard you have not started yet is already satisfied by the one you did pass, which is a scoping question rather than an audit question.
Yes. Every released pair publishes its coverage, the control counts behind it, how many candidate mappings were examined and how many were removed in review. The paid report is the per-control list of what is evidenced and what is a gap.
The graph holds 686 frameworks and 59,123 judged cross-framework mappings, with 29,347 more that were judged and rejected and kept where you can read them.