For Fractional CISOs
The overlap between what your clients already hold and what they are being asked for, judged control by control, so you can price the work before you agree to it.
The job: Scope a security programme for a company you joined three weeks ago, accurately enough to commit to it.
A prospect holds SOC 2 and a customer is demanding ISO 27001. The number that decides whether that is a quarter or a year is directional coverage, and it is published for every released pair before you pay anything.
Find the pairThe judgement is done once and reused. Where a pair is not released it is built to order at the same price, and occasionally refused outright when the two frameworks genuinely have little in common.
See how the judging worksWhen a client asks why their existing control counts, the answer is a record: which control does the work, what it satisfies, the document each side was verified against, and whether the claim survived a pass that argued against it.
Read a claim end to endIt will not run the programme for you. There is no evidence collection, no ticketing, no monitoring of a client estate. It answers what to do and in what order, not whether it got done.
Yes. Nothing here is scoped per client organisation, because the graph is about the standards rather than about anyone's environment. The crosswalk reports are bought per framework pair and a pair you buy for one client is the same pair for the next.
Controls carry the document each was verified against and the date, so you can see the edition rather than assume it. Where an edition has moved and we have not caught up, the date says so instead of the page implying freshness it does not have.
The graph holds 686 frameworks and 59,197 judged cross-framework mappings, with 42,246 more that were judged and rejected and kept where you can read them.