The framework crosswalk
Answer in the language your buyer's framework speaks.
Trusvo maps the evidence in your stack to the criteria auditors and security teams recognise, across 10 frameworks. It is a readiness and alignment view — not a certification, an audit, or a claim that you are compliant.
Every mapping starts from a file.
Evidence is extracted from what you already have, organised into 26 control areas, and each area is mapped to the specific criteria of every framework.
Your evidence
- docs/security-policy.md
- infra/main.tf
- .github/workflows/ci.yml
- docker-compose.yml
- TLS · security headers
26 control areas
- Encryption at restEncryption
- Multi-factor authenticationIdentity
- Incident responseOperations
- Backup and recoveryResilience
- Logging and monitoringOperations
- and 21 more areas
10 frameworks
- SOC 2
- ISO 27001:2022
- CAIQ v4
- SIG-Lite-style
- NIST CSF 2.0
- ISO 42001 (AI)
- EU AI Act (provider duties)
- GDPR (Art. 32)
- HIPAA Security Rule
- PCI DSS v4.0
What it does
- Speaks the buyer's language on their questionnaire
- Shows which criteria your evidence already backs
- Flags the gaps instead of inflating them
What it is not
- Not a certification, attestation or audit report
- Not a claim that you are compliant
- Not a substitute for an auditor, QSA or DPO
10 frameworks, grouped the way buyers name them
The same crosswalk runs in your workspace and every trust room, so what you read here is what your buyer sees.
Audit standards and control frameworks
The attestations and control catalogues buyers cite by name.
- SOC 2
The AICPA Trust Services Criteria — the attestation most SaaS buyers ask for first.
- ISO 27001:2022
The international standard for an information-security management system and its Annex A control set.
- NIST CSF 2.0
The NIST Cybersecurity Framework — posture across Govern, Identify, Protect, Detect, Respond and Recover.
- ISO 42001 (AI)
The management-system standard for responsible AI, increasingly asked of vendors shipping AI features.
Industry questionnaires
The standardised vendor questionnaires procurement teams send.
- CAIQ v4
The Cloud Security Alliance's Consensus Assessments questionnaire — a standard set of cloud-vendor questions (used with attribution).
- SIG-Lite-style
Categories in the style of Shared Assessments' SIG questionnaire (paraphrased — the SIG text itself is licensed).
Regulations · scoped subsets
Not control catalogues — only the duties a technical control can evidence are mapped, each with its scope note.
- EU AI Act (provider duties)
The provider duties for high-risk AI systems that a technical control can evidence.
- GDPR (Art. 32)
The EU regulation's security-of-processing duties, centred on Article 32.
- HIPAA Security Rule
The HIPAA Security Rule safeguards for protected health information (45 CFR Part 164, Subpart C).
- PCI DSS v4.0
The PCI DSS v4.0 requirement families for a cardholder-data environment.
The regulations, scoped honestly
The EU AI Act, GDPR, HIPAA and PCI DSS are not control catalogues. Trusvo maps only the part a technical control can evidence — and says so wherever they appear.
GDPR (Art. 32)
Covers GDPR's security-of-processing duties (especially Art. 32) and adjacent articles. It does not evidence lawful basis, data-subject-request fulfilment, DPO appointment, DPIAs or records of processing — those are organisational obligations, not security controls.
HIPAA Security Rule
Covers the HIPAA Security Rule safeguards (45 CFR Part 164, Subpart C). It is not a HIPAA attestation and does not cover the Privacy Rule or Breach Notification Rule in full; it applies only where PHI is handled.
PCI DSS v4.0
Covers PCI DSS v4.0 requirement families. PCI DSS applies only within a defined cardholder-data environment; actual compliance requires correct scoping and an SAQ or ROC (a QSA assessment above set thresholds).
EU AI Act (provider duties)
Covers the provider duties for high-risk AI systems that a technical control can evidence — logging (Art. 12), accuracy, robustness and cybersecurity (Art. 15), human oversight (Art. 14), data governance (Art. 10) and post-market obligations (Art. 72–73). It does not establish your risk classification and does not cover conformity assessment, CE marking, EU database registration, fundamental-rights impact assessment or the general-purpose AI obligations in Chapter V. Whether a system is high-risk is a legal determination this tool does not make.
Readiness view mapping evidence to recognised criteria — not a certification or audit claim.
See how far your evidence already reaches.
Import your repo and watch the crosswalk fill in — which criteria your stack backs today across 10 frameworks, and exactly where the gaps are.