Six-monthly access reviews
Vendor accounts included, which gives SOC 2 and ISO a richer population too.
Multi-Framework Compliance & Continuous Assurance
One control set. Many obligations.
A single control and evidence model that meets SOC 2, ISO/IEC 27001, PCI DSS, DORA and more on their own terms, and stays current between audits.
- SOC 2 · ISO/IEC 27001
- PCI DSS · DORA
- NIST CSF 2.0 · HITRUST
- Who it is for
- Organizations answering to two or more frameworks at once
- The model
- One control set and one evidence calendar, with framework-specific outputs
- Our role
- Control design, readiness, continuous assurance and audit management
- The result
- Fewer audit hours, fewer findings and one view of control health
Compliance debt compounds.
Adopt frameworks one at a time and your engineers end up answering the same access question in four formats.
We build one control set, designed to the strictest requirement that applies. Each control has one owner, one description and one evidence routine.
Overlap is real. Equivalence is not. The value lies in knowing exactly where one framework ends.
Outcomes
What a unified program gives you.
Fewer hours of audit preparation. Fewer findings.
01
One owner per control
Described, owned and tested once, with framework references attached.
02
Collect once
Evidence designed to the most demanding frequency and population.
03
A calendar you can plan
Evidence ready before fieldwork begins.
04
A board-level view
One view of control health, not five reports that disagree.
Requirements
Where frameworks genuinely differ.
These differences decide how a unified program must be designed.
| SOC 2 | ISO/IEC 27001:2022 | PCI DSS v4.0.1 | NIST CSF 2.0 | DORA | |
|---|---|---|---|---|---|
| What it is | Attestation report | Certifiable management system | Mandatory card-data standard | Voluntary framework | EU regulation |
| Who issues the outcome | Licensed CPA firm | Accredited certification body | QSA (ROC) or self-assessment (SAQ) | No certificate | Supervised by competent authorities |
| Timing | Point in time or review period | Three-year cycle, surveillance audits | Annual, plus quarterly scans | Continuous | Continuous, with testing duties |
Quarterly scanning
Internal authenticated scans and ASV external scans set the rhythm for every framework.
Register and contract terms
Treat the register as the master provider inventory for every framework.
Complete populations
Evidence must export from source systems, a discipline that strengthens every audit.
Interactive demonstration
One piece of evidence, five frameworks.
Choose an evidence item to see which requirements it supports, and what each framework demands on top.
Loading interactive demonstration…
Every asset, finding and score in this panel is synthetic and generated in your browser. Nothing is scanned, collected or sent.
Continuous assurance
True between audits.
We run the evidence calendar with you, so audit season becomes a confirmation rather than a scramble.
| Activity | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| User access reviewSOC 2 · ISO · PCI · DORA | Yes | Yes | Yes | Yes | ||||||||
| Internal & external vulnerability scansPCI (quarterly) · SOC 2 · ISO · DORA | Yes | Yes | Yes | Yes | ||||||||
| Penetration testPCI (annual + significant change) · SOC 2 · ISO · DORA | Yes | |||||||||||
| Segmentation testPCI (six-monthly for service providers) | Yes | Yes | ||||||||||
| Incident response & continuity exercisePCI 12.10.2 · DORA Art. 11(6) · ISO · SOC 2 | Yes | |||||||||||
| Risk assessment & Statement of Applicability reviewISO · SOC 2 · PCI targeted risk analyzes | Yes | |||||||||||
| Third-party provider reviewsDORA register · PCI 12.8.4 · SOC 2 · ISO | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| ISMS management reviewISO/IEC 27001 clause 9.3 | Yes | Yes | ||||||||||
| SOC 2 Type 2 review period | ||||||||||||
| ISO/IEC 27001 surveillance audit | ||||||||||||
| PCI DSS annual assessment | ||||||||||||
Illustrative calendar. Your cadence follows your own control descriptions, risk analyzes and assessment dates. Rolling dots mark activities spread across the year by provider criticality.
01
Calendar ownership
We chase owners and check every artifact before it is filed.
02
Quarterly health reviews
Exceptions surface months before fieldwork, while there is time to fix them.
03
Auditor liaison
One point of contact for your CPA firm, certification body and QSA.
04
Tool-agnostic
We work in the tools you already use. We don’t sell software.
Methodology
How we build one program.
Our five-phase lifecycle, applied to compliance.
- Phase 01
Discover
Every obligation, with its scope and timing.
- Phase 02
Assess
Controls rationalized and gaps mapped by framework.
- Phase 03
Remediate
Controls redesigned to the strictest requirement.
- Phase 04
Validate
Readiness testing before each formal audit.
- Phase 05
Sustain
Calendar operation and change review.
Capabilities & deliverables
What the service includes.
From a one-off rationalization to a retained program.
Rationalization & sequencing
Which frameworks you need, in the order that reuses the most work.
- Obligation inventory
- Two-year assurance roadmap
Unified control framework
One library with framework references, owners and testing attributes.
- Controls an auditor can test
- Statement of Applicability alignment
Evidence model & calendar
What evidence, from which system, how often and who signs off.
- Population completeness checks
- Automation where tools allow
Framework readiness
Mock testing against each framework before the formal event.
- Mock sampling
- Remediation plans
Audit coordination
One program office for request lists, walkthroughs and evidence.
- Shared request tracking
Continuous assurance
Controls operating and evidence current between audits.
- Quarterly health reviews
- Change-impact assessment
Accreditation & scope
One program office for every audit
What MarkTillson delivers
- Program design and evidence models
- Readiness assessments against each framework
- Continuous assurance and audit coordination
Formal assessments in-house
- PCI DSS Reports on Compliance, from your QSA company
- Quarterly external scans, from your Approved Scanning Vendor
- FedRAMP assessments, from your 3PAO
- CMMC Level 2 certification, from your C3PAO
Framework mapping
Control areas across six frameworks.
The starting point for a unified control set, read alongside each framework’s own text.
| Control area | SOC 2 | ISO/IEC 27001 | PCI DSS | NIST CSF 2.0 | DORA | HITRUST CSF |
|---|---|---|---|---|---|---|
| Access control | Directly addressed | Directly addressed | Directly addressed | Directly addressed | Directly addressed | Directly addressed |
| Vulnerability management | Directly addressed | Directly addressed | Directly addressed | Directly addressed | Directly addressed | Directly addressed |
| Change management | Directly addressed | Directly addressed | Directly addressed | Partially addressed | Directly addressed | Directly addressed |
| Business continuity & resilience | Partially addressed | Directly addressed | Partially addressed | Directly addressed | Directly addressed | Directly addressed |
| Cryptography & key management | Partially addressed | Directly addressed | Directly addressed | Partially addressed | Directly addressed | Directly addressed |
| Secure development | Partially addressed | Directly addressed | Directly addressed | Partially addressed | Partially addressed | Directly addressed |
| Privacy | Partially addressed | Partially addressed | Not addressed– | Partially addressed | Not addressed– | Partially addressed |
Directly addressed Partially addressed or different evidence expectations , Not a primary objective. SOC 2 coverage depends on the categories in scope. Each framework’s own text governs.
Industry considerations
The combinations we see.
SOC 2 for North America and ISO/IEC 27001 everywhere else, then PCI DSS once payments arrive.
SOC 2 readinessPCI DSS sets the baseline, and bank partners pass down DORA contract terms.
PCI DSS assessmentDORA is the legal backbone. SWIFT CSCF and PCI DSS apply as scoped overlays.
DORA readinessHITRUST alongside SOC 2, with both covering HIPAA Security Rule obligations.
HITRUST readinessISO/IEC 42001 shares the ISO management-system structure. Extend the ISMS rather than duplicating it.
ISO/IEC 42001Use cases
Programs we untangle.
Two audits, one control set
Shared scope and shared evidence, with fieldwork aligned.
Adding PCI DSS
Controls extended wherever PCI DSS is more prescriptive.
Bank clients passing down terms
Evidence for contract, incident and testing duties.
Merging two programs
Two control sets combined into one, without a coverage gap.
FAQs
Questions compliance teams ask.
Does an ISO/IEC 27001 certificate make us SOC 2 compliant?
No. Much of the evidence carries over, but SOC 2 is a separate attestation signed by a licensed CPA firm. We plan both so the work is done once.
Can one audit cover several frameworks?
Fieldwork can often be coordinated, but each framework produces its own report or certificate. We plan the calendar so the same evidence serves every event.
Which framework should we pursue first?
The one that unblocks revenue or meets a legal duty. Design your controls to the most prescriptive framework you will need within two years.
Do you sell a compliance platform?
No. We are tool-agnostic and work inside the systems you already use.
How is continuous assurance priced?
It is scoped to your frameworks and the depth of support you want. You receive a written proposal after the first conversation.
Related
Frameworks we bring together.
Speak with an expert
Stop answering the same question four ways.
Tell us which frameworks you answer to. A senior practitioner will come back with a sequencing plan and an estimate of the work you can stop duplicating.