Seventeen frameworks, one record underneath¶

Kanonik works with 17 frameworks: SOC 2, ISO/IEC 27001, HIPAA, GDPR, NIST CSF 2.0, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2, NIST SP 800-171 Rev. 3, FedRAMP Rev. 5 baselines, GovRAMP Rev. 5 baselines, CCPA/CPRA, DORA, NIS2, NYDFS Part 500, EU AI Act, NIST AI RMF 1.0 and NIST SSDF.

Each loads as a versioned package onto the same trust layer: the same canonical record, the same Verifier, the same approval gate, the same sealed export. NIST CSF 2.0 and GDPR come with every plan. Three of them are audited frameworks, described in the next section. Audit-Ready includes one, and another is $3,000 a year. Enterprise includes every framework. Plans and pricing has the details.

For ISO/IEC 27001, Kanonik uses the clause numbers with its own descriptions and never the standard's text. It asks you to confirm you hold a licensed copy before it builds your audit package.

What you get with the audited frameworks¶

ISO 27001¶

Every clause and Annex A control by number, with Kanonik's own description of what each one asks. You confirm you hold a licensed copy of the standard before Kanonik builds your audit package. Your AI drafts the Statement of Applicability and the control mapping; the Verifier checks each decision; you approve; the record seals it. The output is the artifact set an ISO auditor actually asks for, with the reasoning trail behind every applicability call.

SOC 2 (Trust Services Criteria)¶

The Trust Services Criteria load onto the same canonical record, so the controls and evidence you already recorded project onto SOC 2 rather than being retyped into it. You get the applicability statement, the criteria-to-control mapping, and sealed records that show who wrote, verified, and approved every entry.

HIPAA¶

The Administrative Simplification rules (45 CFR Part 164) load as a package covering the administrative, physical, technical, organizational, privacy and breach-notification families, with required and addressable implementation specifications distinguished as the rule distinguishes them. HIPAA is US federal regulation and therefore public domain: there is no text to buy and no licence to attest, so you can activate it and start immediately.

Kanonik supports the HIPAA framework package as control and evidence content. It is not a HIPAA Business Associate, does not sign a Business Associate Agreement, and protected health information (PHI) should not be entered into Kanonik.

The frameworks that come with every plan¶

Records of Processing Activities under Article 30, DPIAs, and processing activities, recorded and verified continuously. When a regulator, a data protection authority, or an enterprise customer asks, a Sealed Audit Package produces the signed bundle. You can also grant them read-only access to your workspace until a date you set.

NIST CSF 2.0¶

The CSF 2.0 functions and categories load as a package and map onto the controls you already hold in the canonical record. You get the profile-style applicability statement, the category-to-control mapping, and the same sealed chain behind every assessment your AI proposes and you approve.

Your own licensed copy, where one is required¶

ISO 27001 and SOC 2 are copyrighted standards. Kanonik holds none of their text and none of their titles: it uses the clause numbers and its own descriptions, written from scratch. Kanonik asks you to confirm you hold a licensed copy, and won't build an audit package for either until you have.

GDPR, NIST CSF 2.0 and HIPAA are public text. There is nothing to buy and nothing to attest.

This is the same posture your auditor already expects: the organization under audit holds its own copy of the standard it is audited against.

Author once, map across frameworks¶

Adding a framework is a projection onto the record you already keep, which is why a second framework is mostly recognition of work you already did rather than a second program. The activation generates the new framework's Statement of Applicability and control mapping, runs them through the Verifier, and seals them.

A framework is a versioned package that loads onto the controls and evidence you already have, not a rebuild. If you need one that is not on the list, ask for it at [email protected].